]> granicus.if.org Git - postgresql/commit
pgcrypto: Detect and report too-short crypt() salts.
authorNoah Misch <noah@leadboat.com>
Mon, 5 Oct 2015 14:06:29 +0000 (10:06 -0400)
committerNoah Misch <noah@leadboat.com>
Mon, 5 Oct 2015 14:06:33 +0000 (10:06 -0400)
commit4d6752277e792386e54b036aee8f64ee4fa84cf1
treed1f8f946ac3497cc9a5b35e574cd051e8ecebf5d
parentbd9014768035dd70f8cc33c215a8b929c2e13a35
pgcrypto: Detect and report too-short crypt() salts.

Certain short salts crashed the backend or disclosed a few bytes of
backend memory.  For existing salt-induced error conditions, emit a
message saying as much.  Back-patch to 9.0 (all supported versions).

Josh Kupershmidt

Security: CVE-2015-5288
contrib/pgcrypto/crypt-blowfish.c
contrib/pgcrypto/crypt-des.c
contrib/pgcrypto/expected/crypt-blowfish.out
contrib/pgcrypto/expected/crypt-des.out
contrib/pgcrypto/expected/crypt-xdes.out
contrib/pgcrypto/px-crypt.c
contrib/pgcrypto/sql/crypt-blowfish.sql
contrib/pgcrypto/sql/crypt-des.sql
contrib/pgcrypto/sql/crypt-xdes.sql