[wp-trac] [WordPress Trac] #61258: class-phpass.php uses old '2a' prefix for crypt_blowfish hashes

[WordPress Trac]

#61258: class-phpass.php uses old '2a' prefix for crypt_blowfish hashes
--------------------------+-----------------------------
 Reporter:  timrutter     |      Owner:  (none)
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Security      |    Version:  trunk
 Severity:  normal        |   Keywords:  has-patch
  Focuses:                |
--------------------------+-----------------------------
 class-phpass.php currently uses the old '2a' prefix for crypt_blowfish
 hashes

 Since PHP 5.3.7 (crypt_blowfish 1.2) the prefix of '2y' has been
 recommended.

 The prefix '$2y$' is used to identify correctly computed hashes from the
 older potentially weak '$2a$' hashes from CVE-2011-2483

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/61258>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform