Bug #19834: Weak encryption key generation vulnerability in sysext install - TYPO3 Core - TYPO3 Forge

Actions

Bug #19834

closed

Weak encryption key generation vulnerability in sysext install

Added by Marcus Krause almost 16 years ago. Updated about 6 years ago.

Status:

Closed

Priority:

Must have

Assignee:

Category:

Install Tool

Target version:

-

Start date:

2009-01-15

Due date:

% Done:

0%

Estimated time:

TYPO3 Version:

4.0

PHP Version:

5.2

Tags:

Complexity:

Is Regression:

Sprint Focus:

Description

Versions:
4.0 up to trunk (4.0, 4.1, 4.2, trunk)

Problem:
The install tool generates encryption keys with a very low entropy.

Solution:
Use t3lib_div::generateRandomBytes() instead of the vulnerable JavaScript implementation.

Provided by TYPO3 Security Team
(issue imported from #M10154)

Files

Download all files

10154.diff (8.45 KB) 10154.diff		Administrator Admin, 2009-01-16 02:28
10154_trunk_v1.diff (8.37 KB) 10154_trunk_v1.diff		Administrator Admin, 2009-01-16 02:52
10154_4-2_v2.diff (9.82 KB) 10154_4-2_v2.diff		Administrator Admin, 2009-01-16 02:57
10154_4-2_v3.diff (9.62 KB) 10154_4-2_v3.diff		Administrator Admin, 2009-01-19 23:45
10154_4-1_v3.diff (9.53 KB) 10154_4-1_v3.diff		Administrator Admin, 2009-01-19 23:45
10154_trunk_v3.diff (8.27 KB) 10154_trunk_v3.diff		Administrator Admin, 2009-01-20 00:02
10154_4-0_v3.diff (8.28 KB) 10154_4-0_v3.diff		Administrator Admin, 2009-01-20 00:03
10154_4-0_v4.diff (8.51 KB) 10154_4-0_v4.diff		Administrator Admin, 2009-01-20 01:42
10154_4-1_v4.diff (9.82 KB) 10154_4-1_v4.diff		Administrator Admin, 2009-01-20 01:42

Related issues 1 (0 open — 1 closed)

Actions

#1

Updated by Marcus Krause almost 16 years ago

patch added for trunk

Actions

#2

Updated by Marcus Krause almost 16 years ago

patch added for 4-2

Actions

#3

Updated by Marcus Krause almost 16 years ago

patch to be applied on 4-0 and 4-1 added (10154.diff)

Actions

#4

Updated by Marcus Krause almost 16 years ago

added new versions of patches for 4-1 and 4-2:
- registration of AJAX-scripts in ext_localconf.php instead of global config_default.php

Actions

#5

Updated by Marcus Krause almost 16 years ago

ready to be committed

Actions

#6

Updated by Helmut Hummel almost 16 years ago

upload reworked patches, use patches with the _v3 suffix for the commit!!

Actions

#7

Updated by Marcus Krause almost 16 years ago

added _v4 patches for 4-0 and 4-1 as _v3 ones didn't apply properly - no functionality changes!

Actions

#8

Updated by Ingo Renner almost 16 years ago

fixed in 4.0.10, 4.1.8, 4.2.4, and trunk

Actions

#9

Updated by Benni Mack about 6 years ago

Status changed from Resolved to Closed

Actions

Also available in: Atom PDF