What’s Vulnerable › Vulnerabilities

CVE-2011-2483

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2011-08-25 · updated 2026-06-16
• Weakness: CWE-310

Description

crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.

Affected products

• Openwall Crypt Blowfish: before 1.1 — fixed in 1.1
• PHP: before 5.3.7 — fixed in 5.3.7
• PostgreSQL: from 8.2.0 before 8.2.22; from 8.3.0 before 8.3.16; from 8.4.0 before 8.4.9; from 9.0.0 before 9.0.5 — fixed in 8.2.22, 8.3.16, 8.4.9, 9.0.5

How to fix

Upgrade to a fixed version: Openwall Crypt Blowfish 1.1; PHP 5.3.7; PostgreSQL 8.2.22, 8.3.16, 8.4.9, 9.0.5. Check the vendor advisory for mitigations.

References

• http://freshmeat.net/projects/crypt_blowfish
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
• http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00015.html
• http://php.net/security/crypt_blowfish
• http://support.apple.com/kb/HT5130
• http://www.debian.org/security/2011/dsa-2340
• http://www.debian.org/security/2012/dsa-2399
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:165
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:178
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:179
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:180

Get alerted when CVE-2011-2483 or the next vulnerability affects your stack