It was found that cumin used the crypt(3) DES-based hash function with insufficient salt to store passwords. This hash function has known weaknesses, and an attacker who compromises the user database could use this flaw to recover plaintext passwords.
Acknowledgements: This issue was discovered by Tomáš Nováčik of the Red Hat MRG Quality Engineering team.
*** Bug 1043443 has been marked as a duplicate of this bug. ***
Easy to test: 1) Copy a user database from a previous version of cumin cumin-admin export-users users 2) Verify that the password fields have no salt prefix (more users) 3) Set up the new version of cumin 4) Import the user database cumin-admin import-users users 5) Run cumin and log in as an old user -- proves that old hashes still work 6) Use change password to set the user's password to the same value 7) Log out and log in again -- works 8) Add a brand new user cumin-admin add-user newguy somepassword 9) Export the user db and verify that the $6 salt prefix is added in both cases cumin-admin export-users updated_users
Note, if we want a security advisory on this, uses can just be instructed to change their password the next time they log in after installation. This will switch the hash, even if they reset to the same password. (unless of course they're using LDAP, when it doesn't matter)
This issue has been addressed in following products: MRG for RHEL-5 v. 2 Via RHSA-2014:0441 https://rhn.redhat.com/errata/RHSA-2014-0441.html
This issue has been addressed in following products: MRG for RHEL-6 v.2 Via RHSA-2014:0440 https://rhn.redhat.com/errata/RHSA-2014-0440.html