Unscored severity · published Jul 5, 2012
CVE-2012-2143
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if…
–
CVSS
5.7%
EPSS
No
On KEV
Description
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.7% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
before 5.3.14; 5.4.0 before 5.4.4 · source: NVD
PO
PostgreSQL · PostgreSQL
8.3 before 8.3.19; 8.4 before 8.4.12; 9.0 before 9.0.8; 9.1 before 9.1.4 · source: NVD
DL
Debian Linux · Debian
6.0 · source: NVD
FR
Freebsd · Freebsd
through 9.0; 1.0; 1.1; 1.1.5; 1.1.5.1; 2.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2143
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2143
Broken Link
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aab49e934de1fff046e659cbec46e3d053b41c34
Vendor Advisory
http://git.postgresql.org/gitweb/?p=postgresql.git&a=commit&h=932ded2ed51e8333852e370c7a6dad75d9f236f9
Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
Mailing List
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082258.html
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082292.html
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability