oss-sec mailing list archives
Re: Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version
From: Ralf Schlatterbeck <rsc () runtux com>
Date: Thu, 15 Nov 2012 11:36:37 +0100
On Wed, Nov 14, 2012 at 10:26:16AM -0700, Kurt Seifried wrote:
[A] Doesn't have security implications if roundup is correnctly configured. The bug would create a python backtrace. Unless the "debug" option in section [web] is set (which is explicitly discouraged) this will only display "an error has occurred" in the web-interface. Even if someone sets the debug option in a production release only the hashed password could be disclosed. Note that this bug only affects the anydbm backend which should not be used for a production version either.How is the password hashed?
We're using PBKDF2 now for some time. The number of rounds can be configured and currently defaults to 10000. Note that we encode the used hashing function in the password field in the database. This allows us to upgrade existing passwords on user login to the new scheme. This also means existing installations can have a mixture of password hashing schemes in the DB. The old default scheme was SHA-1 with no salt, see http://issues.roundup-tracker.org/issue2550688 This was changed to PBKDF2 in Release 1.4.17 and there was still the bug [A] remaining in the anydbm backend which was fixed in 1.4.20. This also shows how many people are using that backend (it's mainly used for demo) Ralf -- Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16 Open Source Consulting www: http://www.runtux.com Reichergasse 131, A-3411 Weidling email: office () runtux com osAlliance member email: rsc () osalliance com
Current thread:
- CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version Jan Lieskovsky (Nov 10)
- Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version Jan Lieskovsky (Nov 10)
- Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version Ralf Schlatterbeck (Nov 10)
- Re: Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version Kurt Seifried (Nov 14)
- Re: Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version Ralf Schlatterbeck (Nov 15)
- Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version Ralf Schlatterbeck (Nov 10)
- Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version Jan Lieskovsky (Nov 10)