rdelaage
/
postgresql
mirror of https://git.postgresql.org/git/postgresql.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
postgresql/contrib/pgcrypto
History
Tom Lane 932ded2ed5 Fix incorrect password transformation in contrib/pgcrypto's DES crypt(). 
Overly tight coding caused the password transformation loop to stop
examining input once it had processed a byte equal to 0x80.  Thus, if the
given password string contained such a byte (which is possible though not
highly likely in UTF8, and perhaps also in other non-ASCII encodings), all
subsequent characters would not contribute to the hash, making the password
much weaker than it appears on the surface.

This would only affect cases where applications used DES crypt() to encode
passwords before storing them in the database.  If a weak password has been
created in this fashion, the hash will stop matching after this update has
been applied, so it will be easy to tell if any passwords were unexpectedly
weak.  Changing to a different password would be a good idea in such a case.
(Since DES has been considered inadequately secure for some time, changing
to a different encryption algorithm can also be recommended.)

This code, and the bug, are shared with at least PHP, FreeBSD, and OpenBSD.
Since the other projects have already published their fixes, there is no
point in trying to keep this commit private.

This bug has been assigned CVE-2012-2143, and credit for its discovery goes
to Rubin Xu and Joseph Bonneau.
 		2012-05-30 10:53:30 -04:00
..
expected Convert contrib modules to use the extension facility. 2011-02-13 22:54:49 -05:00
sql Convert contrib modules to use the extension facility. 2011-02-13 22:54:49 -05:00
.gitignore Support "make check" in contrib 2011-04-25 22:27:11 +03:00
Makefile Convert contrib modules to use the extension facility. 2011-02-13 22:54:49 -05:00
blf.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
blf.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
crypt-blowfish.c Remove many -Wcast-qual warnings 2011-09-11 21:54:32 +03:00
crypt-des.c Fix incorrect password transformation in contrib/pgcrypto's DES crypt(). 2012-05-30 10:53:30 -04:00
crypt-gensalt.c Remove many -Wcast-qual warnings 2011-09-11 21:54:32 +03:00
crypt-md5.c Even more duplicate word removal, in the spirit of the season 2012-05-02 20:56:03 +03:00
fortuna.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
fortuna.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
imath.c Lots of doc corrections. 2012-04-23 22:43:09 -04:00
imath.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
internal-sha2.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
internal.c Standardize treatment of strcmp() return value 2011-12-27 21:19:09 +02:00
mbuf.c pgcrypto: Remove inappropriate const qualifier 2012-01-15 14:00:52 +02:00
mbuf.h pgcrypto: Remove inappropriate const qualifier 2012-01-15 14:00:52 +02:00
md5.c Remove unnecessary #include references, per pgrminclude script. 2011-09-01 10:04:27 -04:00
md5.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
openssl.c Standardize treatment of strcmp() return value 2011-12-27 21:19:09 +02:00
pgcrypto--1.0.sql Don't quote language name 2011-11-17 18:35:07 -03:00
pgcrypto--unpackaged--1.0.sql Throw a useful error message if an extension script file is fed to psql. 2011-10-12 15:45:03 -04:00
pgcrypto.c Fix error detection in contrib/pgcrypto's encrypt_iv() and decrypt_iv(). 2012-01-27 23:09:16 -05:00
pgcrypto.control Convert contrib modules to use the extension facility. 2011-02-13 22:54:49 -05:00
pgcrypto.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-armor.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-cfb.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-compress.c Fix misleading comments 2012-05-08 19:35:22 +03:00
pgp-decrypt.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-encrypt.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-info.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-mpi-internal.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-mpi-openssl.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-mpi.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-pgsql.c Lots of doc corrections. 2012-04-23 22:43:09 -04:00
pgp-pubdec.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-pubenc.c If pk is NULL, the backend would segfault when accessing ->algo and the 2010-10-20 22:24:04 +03:00
pgp-pubkey.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp-s2k.c Clean up most -Wunused-but-set-variable warnings from gcc 4.6 2011-04-11 22:28:45 +03:00
pgp.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
pgp.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
px-crypt.c Standardize treatment of strcmp() return value 2011-12-27 21:19:09 +02:00
px-crypt.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
px-hmac.c Clean up most -Wunused-but-set-variable warnings from gcc 4.6 2011-04-11 22:28:45 +03:00
px.c Standardize treatment of strcmp() return value 2011-12-27 21:19:09 +02:00
px.h Add missing format attributes 2011-09-10 23:12:46 +03:00
random.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
rijndael.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
rijndael.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
rijndael.tbl Remove useless whitespace at end of lines 2010-11-23 22:34:55 +02:00
sha1.c Remove unnecessary #include references, per pgrminclude script. 2011-09-01 10:04:27 -04:00
sha1.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
sha2.c Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
sha2.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00