postgresql/contrib/pgcrypto
Tom Lane ca59dfa6f7 Apply upstream fix for blowfish signed-character bug (CVE-2011-2483).
A password containing a character with the high bit set was misprocessed
on machines where char is signed (which is most).  This could cause the
preceding one to three characters to fail to affect the hashed result,
thus weakening the password.  The result was also unportable, and failed
to match some other blowfish implementations such as OpenBSD's.

Since the fix changes the output for such passwords, upstream chose
to provide a compatibility hack: password salts beginning with $2x$
(instead of the usual $2a$ for blowfish) are intentionally processed
"wrong" to give the same hash as before.  Stored password hashes can
thus be modified if necessary to still match, though it'd be better
to change any affected passwords.

In passing, sync a couple other upstream changes that marginally improve
performance and/or tighten error checking.

Back-patch to all supported branches.  Since this issue is already
public, no reason not to commit the fix ASAP.
2011-06-21 14:41:05 -04:00
..
expected Convert contrib modules to use the extension facility. 2011-02-13 22:54:49 -05:00
sql Convert contrib modules to use the extension facility. 2011-02-13 22:54:49 -05:00
.gitignore Support "make check" in contrib 2011-04-25 22:27:11 +03:00
blf.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
blf.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
crypt-blowfish.c Apply upstream fix for blowfish signed-character bug (CVE-2011-2483). 2011-06-21 14:41:05 -04:00
crypt-des.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
crypt-gensalt.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
crypt-md5.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
fortuna.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
fortuna.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
imath.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
imath.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
internal-sha2.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
internal.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
Makefile Convert contrib modules to use the extension facility. 2011-02-13 22:54:49 -05:00
mbuf.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
mbuf.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
md5.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
md5.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
openssl.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgcrypto--1.0.sql Avoid use of CREATE OR REPLACE FUNCTION in extension installation files. 2011-02-13 22:54:52 -05:00
pgcrypto--unpackaged--1.0.sql Convert contrib modules to use the extension facility. 2011-02-13 22:54:49 -05:00
pgcrypto.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgcrypto.control Convert contrib modules to use the extension facility. 2011-02-13 22:54:49 -05:00
pgcrypto.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-armor.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-cfb.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-compress.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-decrypt.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-encrypt.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-info.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-mpi-internal.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-mpi-openssl.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-mpi.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-pgsql.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-pubdec.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-pubenc.c If pk is NULL, the backend would segfault when accessing ->algo and the 2010-10-20 22:24:04 +03:00
pgp-pubkey.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-s2k.c Clean up most -Wunused-but-set-variable warnings from gcc 4.6 2011-04-11 22:28:45 +03:00
pgp.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
px-crypt.c Apply upstream fix for blowfish signed-character bug (CVE-2011-2483). 2011-06-21 14:41:05 -04:00
px-crypt.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
px-hmac.c Clean up most -Wunused-but-set-variable warnings from gcc 4.6 2011-04-11 22:28:45 +03:00
px.c Clean up most -Wunused-but-set-variable warnings from gcc 4.6 2011-04-11 22:28:45 +03:00
px.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
random.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
rijndael.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
rijndael.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
rijndael.tbl Remove useless whitespace at end of lines 2010-11-23 22:34:55 +02:00
sha1.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
sha1.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
sha2.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
sha2.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00