Date: Tue, 21 Jun 2011 09:56:23 -0600 From: Vincent Danen <vdanen@...hat.com> To: oss-security@...ts.openwall.com Cc: magnum <rawsmooth@...dband.net>, Pierre Joye <pierre.php@...il.com> Subject: Re: CVE request: crypt_blowfish 8-bit character mishandling * [2011-06-20 09:01:11 +0400] Solar Designer wrote: [...] >As to what's affected besides crypt_blowfish itself, I expect it to be >PHP (the code in php-5.3.7RC1 looks affected), Linux distros that use >crypt_blowfish (Owl, ALT Linux, SUSE), and some others (I'll try to >identify them and notify the maintainers). PostgreSQL is affected as well (the pgcrypto module): % head crypt-blowfish.c /* * $PostgreSQL: pgsql/contrib/pgcrypto/crypt-blowfish.c,v 1.14 2009/06/11 14:48:52 momjian Exp $ * * This code comes from John the Ripper password cracker, with reentrant * and crypt(3) interfaces added, but optimizations specific to password * cracking removed. php-suhosin also contains the same code. -- Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ