CVE-2017-7252 bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password.
HighCVSS 7.5
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| botan project botan | >= 1.11.0, < 2.1.0 | 2.1.0 |
References
- botan.randombit.net vendor-advisory
- bugzilla.suse.com issue-tracking