[wp-trac] [WordPress Trac] #61258: class-phpass.php uses old '2a' prefix for crypt_blowfish hashes
WordPress Trac
noreply at wordpress.org
Tue May 21 05:42:04 UTC 2024
#61258: class-phpass.php uses old '2a' prefix for crypt_blowfish hashes
--------------------------+-----------------------------
Reporter: timrutter | Owner: (none)
Type: defect (bug) | Status: new
Priority: normal | Milestone: Awaiting Review
Component: Security | Version: trunk
Severity: normal | Keywords: has-patch
Focuses: |
--------------------------+-----------------------------
class-phpass.php currently uses the old '2a' prefix for crypt_blowfish
hashes
Since PHP 5.3.7 (crypt_blowfish 1.2) the prefix of '2y' has been
recommended.
The prefix '$2y$' is used to identify correctly computed hashes from the
older potentially weak '$2a$' hashes from CVE-2011-2483
--
Ticket URL: <https://core.trac.wordpress.org/ticket/61258>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform
More information about the wp-trac
mailing list