First Last Prev Next    This bug is not in your last search results.
Bug 55010 - Fix UMCAndSecretAuthenticator hash comparision
Fix UMCAndSecretAuthenticator hash comparision
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Portal
UCS 5.0
Other Linux
: P5 normal (vote)
: UCS 5.0-2-errata
Assigned To: Florian Best
Dirk Wiesenthal
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2022-07-19 14:46 CEST by Florian Best
Modified: 2022-08-03 17:08 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Development Internal
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Best univentionstaff 2022-07-19 14:46:06 CEST 
The password comparision in UMCAndSecretAuthenticator does not work.

>>> hashlib.sha512(b'foo') == hashlib.sha512(b'foo')                                                                                                                                                                                          
False
>>> hashlib.sha512(b'foo').hexdigest() == hashlib.sha512(b'foo').hexdigest()                                                                                                                                                                  
True
Comment 1 Florian Best univentionstaff 2022-07-19 14:49:04 CEST 
univention-portal.yaml
655d58813a90 | Bug #55010: fix password hash comparision

univention-portal (4.0.7-6)
655d58813a90 | Bug #55010: fix password hash comparision
Comment 2 Florian Best univentionstaff 2022-07-19 15:08:08 CEST 
Also the group cache contains only lowercase usernames and is not case insensitive.
Therefore we have to normalize manually.

univention-portal (4.0.7-7)
49553944efaa | Bug #55010: fix normalization of username
Comment 3 Arvid Requate univentionstaff 2022-07-19 18:49:30 CEST 
655d58813a removed the advisory content for Bug #54273
Comment 4 Florian Best univentionstaff 2022-07-19 19:48:41 CEST 
oups, sorry:
4d6e3899d1 Bug #54273: fix advisory
Comment 5 Dirk Wiesenthal univentionstaff 2022-08-03 14:27:48 CEST 
Code review: OK
cURL test: OK
YAML: OK
First Last Prev Next    This bug is not in your last search results.