CVE-2011-2483: Openwall Crypt Blowfish

Medium severity, CVSS 5.0. EPSS: 5% chance of exploitation in the next 30 days.

crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.

Affected products

• Openwall Crypt Blowfish: before 1.1 (fixed in 1.1)
• PHP PHP: before 5.3.7 (fixed in 5.3.7)
• PostgreSQL PostgreSQL: from 8.2.0, before 8.2.22 (fixed in 8.2.22); from 8.3.0, before 8.3.16 (fixed in 8.3.16); from 8.4.0, before 8.4.9 (fixed in 8.4.9); from 9.0.0, before 9.0.5 (fixed in 9.0.5)

Published 2011-08-25. Last modified 2026-06-16.