Security Advisories (1)
CVE-2012-2143 (2012-05-07)

The crypt_des (aka DES-based crypt) function does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.

Changes for version 0.600 - 2011-07-20

  • Add support for Apache's apr1 crypt scheme.
  • Fix warnings about conversion from char* to unsigned char* in md5_append() calls.

Modules

Full XS implementation of common crypt() algorithms UNAUTHORIZED