Unscored severity · published Aug 25, 2011
CVE-2011-2483
crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it…
–
CVSS
5%
EPSS
No
On KEV
Description
crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.0% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
before 5.3.7 · source: NVD
PO
PostgreSQL · PostgreSQL
8.2.0 before 8.2.22; 8.3.0 before 8.3.16; 8.4.0 before 8.4.9; 9.0.0 before 9.0.5 · source: NVD
CB
Crypt Blowfish · Openwall
before 1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2483
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2483
Broken Link
http://freshmeat.net/projects/crypt_blowfish
Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
Mailing List
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00015.html
Third Party Advisory
http://php.net/security/crypt_blowfish
Third Party Advisory
http://support.apple.com/kb/HT5130
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability