So it seems that in recent ACF 2021 and ACF 2023 Versions the result of Hash() was changed! This causes serious issues for us, as we compare hashed passwords with the saved and salted counterpart saved in a database. So if ACF meanwhile changes the Hash() values no user can login anymore! Not sure why and when exactly this was done, but I updated today ACF 2021 from version 6 to 17 and ACF 2023 from version 7 to 11. And in both new versions the Hash() value was different then before. You can see it here: https://trycf.com/gist/8862aec63a7c3c224fc53f8a1a535acb/acf2023?theme=monokai Just try it with different versions, with ACF 2023 the values don't match anymore. Is there a way to fix this?

• From Abode website, "ColdFusion (2023 release) Update 8 and ColdFusion (2021 release) Update 14: Changed the default algorithm from CFMX_COMPAT to AES/CBC/PKCS5Padding."

This was changed in 2023 Update 8 and 2021 Update 14. A quick solution is to use the -Dcoldfusion.encryption.useCFMX_COMPATAsDefault=TRUE JVM argument as a temporary work around until you can adjust your code.

Thanks a lot!

The release notes for those updates has more indepth information about the change.

But I use Hash() and not Encrypt(). So applies also to Hash()?

Yes

Note, that the JVM flag is temporary and will be removed in a future update.

Really annoying because different server engines now produce different hash() values ...

Just update all you hash functions to use

MD5

to get it to behave as it did. So

hash( whatever )

to

hash( whatever, "MD5" )

. We use hash for caching things so don't need a strong algorithm but needed our hashes to match to make the cache get hits.

Although, you should really update to something more secure.

You do if you need it to be secure as I say for us it was cache keys so doesn't need to be secure. For passwords etc you should be using a salt or bcrypt etc not hash.