[BugFix] [Vul] Add missing usedforsecurity=False in MD5 hashing to enable FIPS (vllm-project#18319)

Signed-off-by: cascade812 <cascade812@outlook.com>
Signed-off-by: shaoyuyoung <shaoyuyoung@gmail.com>
Co-authored-by: cascade <cascade812@outlook.com>
Signed-off-by: minpeter <kali2005611@gmail.com>

Author: 2 people

vllm/model_executor/model_loader/neuronx_distributed.py

@@ -143,8 +143,8 @@ def load_weights(self, model_name_or_path: str, **kwargs):
         config = neuronx_model_cls.get_config_cls()(
             neuron_config,
             load_config=load_pretrained_config(model_name_or_path))
-        hashed_config = hashlib.md5(
-            config.to_json_string().encode('utf-8')).hexdigest()
+        hashed_config = hashlib.md5(config.to_json_string().encode('utf-8'),
+                                    usedforsecurity=False).hexdigest()
         if os.getenv("NEURON_COMPILED_ARTIFACTS") is not None:
             compiled_model_path = os.getenv("NEURON_COMPILED_ARTIFACTS")
         elif os.path.exists(model_name_or_path):
@@ -263,8 +263,8 @@ def load_weights(self, model_name_or_path: str, **kwargs):
         config = neuronx_model_cls.get_config_cls()(
             neuron_config,
             load_config=load_pretrained_config(model_name_or_path))
-        hashed_config = hashlib.md5(
-            config.to_json_string().encode('utf-8')).hexdigest()
+        hashed_config = hashlib.md5(config.to_json_string().encode('utf-8'),
+                                    usedforsecurity=False).hexdigest()
         if os.getenv("NEURON_COMPILED_ARTIFACTS") is not None:
             compiled_model_path = os.getenv("NEURON_COMPILED_ARTIFACTS")
         elif os.path.exists(model_name_or_path):
@@ -426,8 +426,8 @@ def load_weights(self, model_name_or_path: str,
         config.fused_spec_config = fused_spec_config
         self.config.neuron_config = neuron_config
 
-        hashed_config = hashlib.md5(
-            config.to_json_string().encode('utf-8')).hexdigest()
+        hashed_config = hashlib.md5(config.to_json_string().encode('utf-8'),
+                                    usedforsecurity=False).hexdigest()
         if os.getenv("NEURON_COMPILED_ARTIFACTS") is not None:
             compiled_model_path = os.getenv("NEURON_COMPILED_ARTIFACTS")
         elif os.path.exists(model_name_or_path):