Tom Lane ca59dfa6f7 Apply upstream fix for blowfish signed-character bug (CVE-2011-2483). ... A password containing a character with the high bit set was misprocessed on machines where char is signed (which is most). This could cause the preceding one to three characters to fail to affect the hashed result, thus weakening the password. The result was also unportable, and failed to match some other blowfish implementations such as OpenBSD's. Since the fix changes the output for such passwords, upstream chose to provide a compatibility hack: password salts beginning with $2x$ (instead of the usual $2a$ for blowfish) are intentionally processed "wrong" to give the same hash as before. Stored password hashes can thus be modified if necessary to still match, though it'd be better to change any affected passwords. In passing, sync a couple other upstream changes that marginally improve performance and/or tighten error checking. Back-patch to all supported branches. Since this issue is already public, no reason not to commit the fix ASAP.		2011-06-21 14:41:05 -04:00
..
expected	Convert contrib modules to use the extension facility.	2011-02-13 22:54:49 -05:00
sql	Convert contrib modules to use the extension facility.	2011-02-13 22:54:49 -05:00
.gitignore	Support "make check" in contrib	2011-04-25 22:27:11 +03:00
blf.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
blf.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
crypt-blowfish.c	Apply upstream fix for blowfish signed-character bug (CVE-2011-2483).	2011-06-21 14:41:05 -04:00
crypt-des.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
crypt-gensalt.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
crypt-md5.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
fortuna.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
fortuna.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
imath.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
imath.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
internal-sha2.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
internal.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
Makefile	Convert contrib modules to use the extension facility.	2011-02-13 22:54:49 -05:00
mbuf.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
mbuf.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
md5.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
md5.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
openssl.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgcrypto--1.0.sql	Avoid use of CREATE OR REPLACE FUNCTION in extension installation files.	2011-02-13 22:54:52 -05:00
pgcrypto--unpackaged--1.0.sql	Convert contrib modules to use the extension facility.	2011-02-13 22:54:49 -05:00
pgcrypto.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgcrypto.control	Convert contrib modules to use the extension facility.	2011-02-13 22:54:49 -05:00
pgcrypto.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-armor.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-cfb.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-compress.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-decrypt.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-encrypt.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-info.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-mpi-internal.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-mpi-openssl.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-mpi.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-pgsql.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-pubdec.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-pubenc.c	If pk is NULL, the backend would segfault when accessing ->algo and the	2010-10-20 22:24:04 +03:00
pgp-pubkey.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp-s2k.c	Clean up most -Wunused-but-set-variable warnings from gcc 4.6	2011-04-11 22:28:45 +03:00
pgp.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
pgp.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
px-crypt.c	Apply upstream fix for blowfish signed-character bug (CVE-2011-2483).	2011-06-21 14:41:05 -04:00
px-crypt.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
px-hmac.c	Clean up most -Wunused-but-set-variable warnings from gcc 4.6	2011-04-11 22:28:45 +03:00
px.c	Clean up most -Wunused-but-set-variable warnings from gcc 4.6	2011-04-11 22:28:45 +03:00
px.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
random.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
rijndael.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
rijndael.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
rijndael.tbl	Remove useless whitespace at end of lines	2010-11-23 22:34:55 +02:00
sha1.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
sha1.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
sha2.c	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00
sha2.h	Remove cvs keywords from all files.	2010-09-20 22:08:53 +02:00