[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <51B8D47A.7050705@mccme.ru>
Date: Thu, 13 Jun 2013 00:05:14 +0400
From: Alexander Cherepanov <cherepan@...me.ru>
To: oss-security@...ts.openwall.com
CC: john-users@...ts.openwall.com
Subject: Re: CVE request: WordPress 3.5.1 denial of service
vulnerability
On 2013-06-12 17:11, Solar Designer wrote:
> Arguably, library code should reject the most insane parameter values.
> For example, musl libc - http://www.musl-libc.org - version 0.9.10
> rejects bcrypt's log2(cost)> 19 and limits SHA-crypt's rounds count
> to< 10M for this reason (original SHA-crypt limits to< 1 billion).
On a related note: shouldn't John the Ripper also reject hashes with
insane run-time or memory cost parameters?
--
Alexander Cherepanov
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
