[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110717134821.GA15527@openwall.com>
Date: Sun, 17 Jul 2011 17:48:21 +0400
From: Solar Designer <solar@...nwall.com>
To: Ludwig Nussel <ludwig.nussel@...e.de>
Cc: oss-security@...ts.openwall.com, Michael Matz <matz@...e.de>,
Thorsten Kukuk <kukuk@...e.de>, Andreas Jaeger <aj@...e.de>,
Zefram <zefram@...h.org>, Pierre Joye <pierre.php@...il.com>
Subject: Re: CVE request: crypt_blowfish 8-bit character mishandling
On Thu, Jul 14, 2011 at 04:37:36PM +0200, Ludwig Nussel wrote:
> Solar Designer wrote:
> >I am tempted to just release the current code as 1.2 now. We won't
> >arrive at a perfect solution anyway, because it doesn't exist. And we
> >need to let other projects upgrade to better/safer code (dealing with
> >one-correct to many-buggy collisions) sooner rather than later.
>
> Indeed.
I've just released crypt_blowfish 1.2:
http://www.openwall.com/crypt/
All projects using crypt_blowfish should upgrade to this newer code.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
