HIGH8.1
GHSA-43h9-p3j4-39hm
Liferay Portal defaults to a low work factor for the default password hashing algorithm
Quick fix
GHSA-43h9-p3j4-39hm — com.liferay.portal:release.dxp.bom: upgrade to the fixed version with the command below.
# pom.xml: bump <version>7.3.10.u4</version> for com.liferay.portal:release.dxp.bomDetails
The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/com.liferay.portal:release.dxp.bom
Introduced in:
7.3.0Fixed in: 7.3.10.u4Fix
# pom.xml: bump <version>7.3.10.u4</version> for com.liferay.portal:release.dxp.bomMaven/com.liferay.portal:release.dxp.bom
Introduced in:
0Fixed in: 7.2.10.fp17Fix
# pom.xml: bump <version>7.2.10.fp17</version> for com.liferay.portal:release.dxp.bomMaven/com.liferay.portal:release.dxp.bom
Introduced in:
7.4.0Fixed in: 7.4.13.u16Fix
# pom.xml: bump <version>7.4.13.u16</version> for com.liferay.portal:release.dxp.bomMaven/com.liferay.portal:release.portal.bom
Introduced in:
0Fixed in: 7.4.3.14Fix
# pom.xml: bump <version>7.4.3.14</version> for com.liferay.portal:release.portal.bomMaven/com.liferay.portal:com.liferay.portal.kernel
Introduced in:
0Fixed in: 38.0.0Fix
# pom.xml: bump <version>38.0.0</version> for com.liferay.portal:com.liferay.portal.kernel