NetSight
IP …
medium5.0

CVE-2011-2483

crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit charac…

Impact

crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.

Affected products

VendorProductAffected versions
PhpPhp
before 5.3.7
PostgresqlPostgresql
from 8.2.0 before 8.2.22
from 8.3.0 before 8.3.16
from 8.4.0 before 8.4.9
from 9.0.0 before 9.0.5
OpenwallCrypt Blowfish
before 1.1

Weakness classification

CWE-310

References