Tickets :: Comment on [#9121] decrypted password issue (DIGEST-MD5)

* Your Email Address
* Spam protection	Enter the letters below: . ..__ . , __ .__. \|\ \|[__) \./ / `[__] \| \\|\| \ \| \__.\| \|
Comment	> Dear Horde Team, > > According to: http://www.php.net/manual/en/function.mcrypt-generic.php > > A stored password may be padded with \0, if it's length is not the > same as the block size (8 chars). > > This feature is used by Crypt::Blowfish, which is used again by > Horde::Secret to store password used to do DIGEST-MD5 Authentication. > > I've attached a patch which check the length of the encrypted message. > >
Attachment
Watch this ticket