CVE-2017-7252

bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password.

Score

CVSS 3.1 7.5 High

Status

Modified - cve@mitre.org

Published

2023-11-03

Last modified

2024-09-12

Weaknesses

CWE-319

Affected products

• Botan (Botan Project)

References

• https://botan.randombit.net/security.html
• https://bugzilla.suse.com/show_bug.cgi?id=1034591