New subject: [Issue 10611] slappasswd with sha2 can generate wrong hashes

30 Sep 2026


      https://bugs.openldap.org/show_bug.cgi?id=10611
Issue ID: 10611
           Summary: slappasswd with sha2 can generate wrong hashes
           Product: OpenLDAP
           Version: 2.6.14
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Keywords: needs_review
          Severity: normal
          Priority: ---
         Component: contrib
          Assignee: bugs@openldap.org
          Reporter: ondra@mistotebe.net
  Target Milestone: ---
Depending on compiler version and build flags, SHA256 and SSHA256 can generate
the wrong hash. e.g. hashing password `test`:
- local build (./servers/slapd/slapd -Tp -o
module-load=./contrib/slapd-modules/passwd/sha2/pw-sha2.la -h '{SHA256}' -s
test): `{SHA256}AFQU1hg1xqCsA68tVBURFs7dJbJ25QC/Ancq/MQQXKM=`
- independent (echo -n 'test' | openssl dgst -sha256 -binary | base64):
`n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg=`
The issue appears to be pointer aliasing violation that the compiler optimises
through. Other implementations already carry a fix, so we can apply that.
None of the known packages (Symas, LTB, Debian) that I tested were affected,
they emit the correct hash but this appears to have been quietly patched around
by setting `OPT=-fno-strict-aliasing` without a report I can see here[0]
[0].
https://salsa.debian.org/openldap-team/openldap/-/blob/master/debian/rules?r...
-- 
You are receiving this mail because:
You are on the CC list for the issue.

[Issue 10611] New: slappasswd with sha2 can generate wrong hashes