Closed flesueur closed 2 months ago
Thanks for the report.
The bug was reported to the OpenLDAP core team about 1 year ago. See: https://bugs.openldap.org/show_bug.cgi?id=10010
The code of pw-sha2 has not changed since 2015. Seems this is a bug in gcc.
Bug reproduced on:
Problem is not present on debian 10 (gcc 8.3.0-6) and debian 11 (gcc 10.2.1-6)
Done in 8b4ab33 and f54504e
Hi,
It seems that the SHA256 calculation in pw-sha2 is wrong in 2.5.17.1, which prevents using SHA256/SSHA256 passwords. SHA, SHA384 and SHA512 are ok.
What version is affected ? 2.5.17.1 version on Debian Stable is affected.
What happens ? Users with (correct) SHA256 passwords cannot authenticate with bind. Same users are ok if I change their password hash to SHA, SHA384 or SHA512
How to check ? On a correct implementation :
On 2.5.17.1 :
The SHA256 (without salt) is different. The correct value can be obtained with
It seems similar to https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/2000817
Cheers, François