Author: mvidner Date: Thu Aug 18 13:34:36 2011 New Revision: 65371 URL: http://svn.opensuse.org/viewcvs/yast?rev=65371&view=rev Log: change blowfish id from 2a to 2y (bnc#700876 bnc#706705 CVE-2011-2483) (thanks to Ludwig Nussel) svn merge -c65369 http://svn.opensuse.org/svn/yast/trunk/core Modified: branches/SuSE-Linux-11_3-Branch/core/ (props changed) branches/SuSE-Linux-11_3-Branch/core/VERSION branches/SuSE-Linux-11_3-Branch/core/libycp/src/y2crypt.cc branches/SuSE-Linux-11_3-Branch/core/package/yast2-core.changes Modified: branches/SuSE-Linux-11_3-Branch/core/VERSION URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Linux-11_3-Branch/core/VERSION?rev=65371&r1=65370&r2=65371&view=diff ============================================================================== --- branches/SuSE-Linux-11_3-Branch/core/VERSION (original) +++ branches/SuSE-Linux-11_3-Branch/core/VERSION Thu Aug 18 13:34:36 2011 @@ -1 +1 @@ -2.19.2 +2.19.2.1 Modified: branches/SuSE-Linux-11_3-Branch/core/libycp/src/y2crypt.cc URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Linux-11_3-Branch/core/libycp/src/y2crypt.cc?rev=65371&r1=65370&r2=65371&view=diff ============================================================================== --- branches/SuSE-Linux-11_3-Branch/core/libycp/src/y2crypt.cc (original) +++ branches/SuSE-Linux-11_3-Branch/core/libycp/src/y2crypt.cc Thu Aug 18 13:34:36 2011 @@ -141,7 +141,7 @@ break; case BLOWFISH: - salt = make_crypt_salt ("$2a$", 0); + salt = make_crypt_salt ("$2y$", 0); if (!salt) { y2error ("Cannot create salt for blowfish crypt"); @@ -156,7 +156,9 @@ return false; } - if (!newencrypted) + if (!newencrypted + /* catch retval magic by ow-crypt/libxcrypt */ + || !strcmp(newencrypted, "*0") || !strcmp(newencrypted, "*1")) { y2error ("crypt_r () returns 0 pointer"); return false; Modified: branches/SuSE-Linux-11_3-Branch/core/package/yast2-core.changes URL: http://svn.opensuse.org/viewcvs/yast/branches/SuSE-Linux-11_3-Branch/core/package/yast2-core.changes?rev=65371&r1=65370&r2=65371&view=diff ============================================================================== --- branches/SuSE-Linux-11_3-Branch/core/package/yast2-core.changes (original) +++ branches/SuSE-Linux-11_3-Branch/core/package/yast2-core.changes Thu Aug 18 13:34:36 2011 @@ -1,4 +1,11 @@ ------------------------------------------------------------------- +Thu Aug 18 12:40:23 CEST 2011 - mvidner@suse.cz + +- change blowfish id from 2a to 2y (bnc#700876 bnc#706705 CVE-2011-2483) + (thanks to Ludwig Nussel) +- 2.19.2.1 + +------------------------------------------------------------------- Thu Mar 11 15:36:27 CET 2010 - mvidner@suse.cz - Fixed the regexpsub algorithm not to loop endlessly -- To unsubscribe, e-mail: yast-commit+unsubscribe@opensuse.org For additional commands, e-mail: yast-commit+help@opensuse.org