Advisory Database
  • Advisories
  • Dependency Scanning
  1. gem
  2. ›
  3. bcrypt-ruby
  4. ›
  5. OSVDB-62067

OSVDB-62067: Bug reduced the entropy of hashed passwords containing non US-ASCII characters

February 1, 2010

This package suffered from a bug related to character encoding that substantially reduced the entropy of hashed passwords containing non US-ASCII characters. An incorrect encoding step transparently replaced such characters by ‘?’ prior to hashing. In the worst case of a password consisting solely of non-US-ASCII characters, this would cause its hash to be equivalent to all other such passwords of the same length. This issue only affects the JRuby implementation.

References

  • github.com/codahale/bcrypt-ruby/commit/92c8e4e3760d089e494b7a3ac1faa563681868c7
  • github.com/rubysec/ruby-advisory-db/blob/master/gems/bcrypt-ruby/OSVDB-62067.yml

Code Behaviors & Features

Detect and mitigate OSVDB-62067 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 2.1.4

Fixed versions

  • 2.1.4

Solution

This gem has been renamed. Please use "bcrypt" from now on.

Source file

gem/bcrypt-ruby/OSVDB-62067.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Fri, 30 Oct 2026 12:15:46 +0000.