CVE-2011-2483 crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-d...
MediumCVSS 5.0
EPSS 5.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libxcrypt(Debian:12) | < 1:2.4-1.1 | 1:2.4-1.1 |
| debian/libxcrypt(Debian:13) | < 1:2.4-1.1 | 1:2.4-1.1 |
| debian/libxcrypt(Debian:14) | < 1:2.4-1.1 | 1:2.4-1.1 |
| PHP | < 5.3.7 | 5.3.7 |
| postgresql | >= 8.2.0, < 8.2.22 | 8.2.22 |
| postgresql | >= 8.3.0, < 8.3.16 | 8.3.16 |
| postgresql | >= 8.4.0, < 8.4.9 | 8.4.9 |
| postgresql | >= 9.0.0, < 9.0.5 | 9.0.5 |
| openwall crypt blowfish | < 1.1 | 1.1 |
References
- Debian Security Tracker CVE-2011-2483 vendor-advisory
- freshmeat.net broken-link
- kb.juniper.net third-party-advisory
- APPLE-SA-2012-02-01-1 mailing-list vendor-advisory
- SUSE-SA:2011:035 third-party-advisory vendor-advisory
- php.net third-party-advisory
- support.apple.com third-party-advisory
- DSA-2340 third-party-advisory vdb-entry vendor-advisory
- DSA-2399 third-party-advisory vdb-entry vendor-advisory
- MDVSA-2011:165 broken-link vendor-advisory
- MDVSA-2011:178 broken-link vendor-advisory
- MDVSA-2011:179 broken-link vendor-advisory
- MDVSA-2011:180 broken-link vendor-advisory
- www.openwall.com mailing-list patch third-party-advisory
- www.php.net third-party-advisory
- www.php.net patch vendor-advisory
- www.postgresql.org patch vendor-advisory
- RHSA-2011:1377 broken-link vendor-advisory
- RHSA-2011:1378 broken-link vendor-advisory
- RHSA-2011:1423 broken-link vendor-advisory
- 49241 third-party-advisory vdb-entry
- USN-1229-1 third-party-advisory vendor-advisory
- php-cryptblowfish-info-disclosure(69319) third-party-advisory vdb-entry
- bugs.debian.org issue-tracking