[BugFix] [Vul] Add missing usedforsecurity=False in MD5 hashing to enable FIPS (#18319)

Signed-off-by: cascade812 <[email protected]>
Signed-off-by: shaoyuyoung <[email protected]>
Co-authored-by: cascade <[email protected]>

Author: shaoyuyoung

vllm/model_executor/model_loader/neuronx_distributed.py

@@ -143,8 +143,8 @@ def load_weights(self, model_name_or_path: str, **kwargs):
         config = neuronx_model_cls.get_config_cls()(
             neuron_config,
             load_config=load_pretrained_config(model_name_or_path))
-        hashed_config = hashlib.md5(
-            config.to_json_string().encode('utf-8')).hexdigest()
+        hashed_config = hashlib.md5(config.to_json_string().encode('utf-8'),
+                                    usedforsecurity=False).hexdigest()
         if os.getenv("NEURON_COMPILED_ARTIFACTS") is not None:
             compiled_model_path = os.getenv("NEURON_COMPILED_ARTIFACTS")
         elif os.path.exists(model_name_or_path):
@@ -263,8 +263,8 @@ def load_weights(self, model_name_or_path: str, **kwargs):
         config = neuronx_model_cls.get_config_cls()(
             neuron_config,
             load_config=load_pretrained_config(model_name_or_path))
-        hashed_config = hashlib.md5(
-            config.to_json_string().encode('utf-8')).hexdigest()
+        hashed_config = hashlib.md5(config.to_json_string().encode('utf-8'),
+                                    usedforsecurity=False).hexdigest()
         if os.getenv("NEURON_COMPILED_ARTIFACTS") is not None:
             compiled_model_path = os.getenv("NEURON_COMPILED_ARTIFACTS")
         elif os.path.exists(model_name_or_path):
@@ -426,8 +426,8 @@ def load_weights(self, model_name_or_path: str,
         config.fused_spec_config = fused_spec_config
         self.config.neuron_config = neuron_config
 
-        hashed_config = hashlib.md5(
-            config.to_json_string().encode('utf-8')).hexdigest()
+        hashed_config = hashlib.md5(config.to_json_string().encode('utf-8'),
+                                    usedforsecurity=False).hexdigest()
         if os.getenv("NEURON_COMPILED_ARTIFACTS") is not None:
             compiled_model_path = os.getenv("NEURON_COMPILED_ARTIFACTS")
         elif os.path.exists(model_name_or_path):