Tags and Properties for Check-in 1b5a5d3a6e
- branch=crypt propagates to descendants added by [1fe5668150] on 2016-10-21 04:29:09
- sym-crypt propagates to descendants added by [1fe5668150] on 2016-10-21 04:29:09
- sym-trunk cancelled by [1fe5668150] on 2016-10-21 04:29:09
Context
|
2016-10-21
| ||
| 04:29 | • Edit [1b5a5d3a6e]: Move to branch crypt... artifact: 1fe5668150 user: matt | |
|
2016-10-20
| ||
| 17:53 |
Replace external openssl call with "crypt" egg.
The OpenSSL call was using the old UNIX crypt DES password hashing, which is very weak. Crypt will default to a more sensible mechanism (Blowfish, but in the future could transparently switch). Old passwords will continue to work, because the crypt egg detects DES salts and happily hashes them. When creating new passwords, they will be hashed using the modern algorithm. The OpenSSL call passed the password to the shell, so an onlooker on the server could see it in plaintext. It also neglected to escape the password for the shell, resulting in a command injection vulnerability. check-in: 1b5a5d3a6e user: sjamaan tags: crypt | |