]> granicus.if.org Git - postgresql/commit
pgcrypto: Detect and report too-short crypt() salts.
authorNoah Misch <noah@leadboat.com>
Mon, 5 Oct 2015 14:06:29 +0000 (10:06 -0400)
committerNoah Misch <noah@leadboat.com>
Mon, 5 Oct 2015 14:06:34 +0000 (10:06 -0400)
commitcc1210f0aa441cd0825380ed3fddfeadb6f6533f
treef23b5d4211f38b16d5544b8f0363063c51e3cd20
parent3933417141587253c85285f23c789538aa96a22f
pgcrypto: Detect and report too-short crypt() salts.

Certain short salts crashed the backend or disclosed a few bytes of
backend memory.  For existing salt-induced error conditions, emit a
message saying as much.  Back-patch to 9.0 (all supported versions).

Josh Kupershmidt

Security: CVE-2015-5288
contrib/pgcrypto/crypt-blowfish.c
contrib/pgcrypto/crypt-des.c
contrib/pgcrypto/expected/crypt-blowfish.out
contrib/pgcrypto/expected/crypt-des.out
contrib/pgcrypto/expected/crypt-xdes.out
contrib/pgcrypto/px-crypt.c
contrib/pgcrypto/sql/crypt-blowfish.sql
contrib/pgcrypto/sql/crypt-des.sql
contrib/pgcrypto/sql/crypt-xdes.sql