UpHeron
All vulnerabilities

Servers and applications

CVE-2012-2143

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a…

Severity
Medium 4.3
Published
5 Jul 2012
Last changed
16 Jun 2026
Added to UpHeron
14 Oct 2026
Fixed in
5.3.14, 5.4.4, 8.3.19, 8.4.12, 9.0.8, 9.1.4
Exploit chance
5.7% in the next 30 daysHigher than 93% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
CWE-310
Attack
Over the network · No login needed
Attacker can
Change some data
CVSS vector
AV:N/AC:M/Au:N/C:N/I:P/A:N
Sources
NVD

Description

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.

From NVD.

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • Every version before 5.3.14
  • From 5.4.0 before 5.4.4
PostgreSQLServers and applications · cpe:a:postgresql:postgresql
  • From 8.3 before 8.3.19
  • From 8.4 before 8.4.12
  • From 9.0 before 9.0.8
  • From 9.1 before 9.1.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2012-2143
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2012-2143