Bugzilla – Bug 1034591
VUL-0: CVE-2017-7252: Botan: Botans implementation of bcrypt password hashing scheme truncated longpasswords at 56 characters, ...
Last modified: 2017-05-08 11:55:21 UTC
CVE-2017-7252 Botan’s implementation of bcrypt password hashing scheme truncated long passwords at 56 characters, instead of at bcrypt’s standard 72 characters limit. Passwords with lengths between these two bounds could be cracked more easily than should be the case due to the final password bytes being ignored. References https://botan.randombit.net/security.html#id1 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7252.html
2017-03-23 (CVE-2017-7252): Incorrect bcrypt computation Botan’s implementation of bcrypt password hashing scheme truncated long passwords at 56 characters, instead of at bcrypt’s standard 72 characters limit. Passwords with lengths between these two bounds could be cracked more easily than should be the case due to the final password bytes being ignored. Found and reported by Solar Designer. Bug introduced in 1.11.0, fixed in 2.1.0.
sle12 has 1.10.x , so SLE not affected.
Factory has 1.10.16, and and 2.1.0 is pending for submission to Factory (separate package). Both are unaffected.
Back to security team for further processing.
if its in factory -> good