Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 15 Nov 2012 11:36:37 +0100
From: Ralf Schlatterbeck <>
To: Kurt Seifried <>
Cc:, Jan Lieskovsky <>,
	"Steven M. Christey" <>,
	Michel Alexandre Salim <>,
	Richard Jones <>
Subject: Re: Re: CVE Request -- roundup: Multiple XSS flaws
 plus other security related fixes corrected in upstream 1.4.20 version

On Wed, Nov 14, 2012 at 10:26:16AM -0700, Kurt Seifried wrote:
> > [A] Doesn't have security implications if roundup is correnctly 
> > configured. The bug would create a python backtrace. Unless the
> > "debug" option in section [web] is set (which is explicitly
> > discouraged) this will only display "an error has occurred" in the
> > web-interface. Even if someone sets the debug option in a
> > production release only the hashed password could be disclosed.
> > Note that this bug only affects the anydbm backend which should not
> > be used for a production version either.
> How is the password hashed?

We're using PBKDF2 now for some time. The number of rounds can be
configured and currently defaults to 10000. Note that we encode the used
hashing function in the password field in the database. This allows us
to upgrade existing passwords on user login to the new scheme. This also
means existing installations can have a mixture of password hashing
schemes in the DB.

The old default scheme was SHA-1 with no salt, see

This was changed to PBKDF2 in Release 1.4.17 and there was still the bug
[A] remaining in the anydbm backend which was fixed in 1.4.20. This also
shows how many people are using that backend (it's mainly used for demo)

Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:
Reichergasse 131, A-3411 Weidling       email:
osAlliance member                       email:

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.