Date: Thu, 13 Jun 2013 00:05:14 +0400 From: Alexander Cherepanov <cherepan@...me.ru> To: oss-security@...ts.openwall.com CC: john-users@...ts.openwall.com Subject: Re: CVE request: WordPress 3.5.1 denial of service vulnerability On 2013-06-12 17:11, Solar Designer wrote: > Arguably, library code should reject the most insane parameter values. > For example, musl libc - http://www.musl-libc.org - version 0.9.10 > rejects bcrypt's log2(cost)> 19 and limits SHA-crypt's rounds count > to< 10M for this reason (original SHA-crypt limits to< 1 billion). On a related note: shouldn't John the Ripper also reject hashes with insane run-time or memory cost parameters? -- Alexander Cherepanov
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.