logo

Database

Insecure encryption algorithm In bcrypt-ruby

Description

Bug reduced the entropy of hashed passwords containing non US-ASCII characters

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. GCVE-OSVDB-620672. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bcrypt-ruby/OSVDB-62067.yml

References

1. https://github.com/codahale/bcrypt-ruby/commit/92c8e4e3760d089e494b7a3ac1faa563681868c7

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.