(ofbiz-framework) branch release24.09 updated: Fixed: PBKDF2 password verification always fails in HashCrypt.doComparePbkdf2 (OFBIZ-13609)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 9a256c6a4d Fixed: PBKDF2 password verification always fails in 
HashCrypt.doComparePbkdf2 (OFBIZ-13609)
9a256c6a4d is described below

commit 9a256c6a4d9adc6519fb2e73607ad204452f32a8
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Sat Sep 26 16:08:24 2026 +0530

    Fixed: PBKDF2 password verification always fails in 
HashCrypt.doComparePbkdf2 (OFBIZ-13609)
    
    doComparePbkdf2 wrapped the decoded salt in Arrays.toString(...), so the 
salt used for verification never matched the one used to create the hash, and 
every PBKDF2 login failed even with the correct password. Use the decoded salt 
bytes directly. Hash creation is unchanged, so existing PBKDF2 hashes, 
including pre-2019 ones, verify again.
---
 .../base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java     | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git 
a/framework/base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java 
b/framework/base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java
index daac19b96f..4be9e7d564 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/crypto/HashCrypt.java
@@ -217,8 +217,7 @@ public class HashCrypt {
             String hashType = crypted.substring(1, typeEnd);
             String[] parts = crypted.split("\\$");
             int iterations = Integer.parseInt(parts[0].substring(typeEnd + 1));
-            byte[] salt = 
Arrays.toString(java.util.Base64.getMimeDecoder().decode(parts[1].getBytes(StandardCharsets.UTF_8)))
-                    .getBytes(StandardCharsets.UTF_8);
+            byte[] salt = 
java.util.Base64.getMimeDecoder().decode(parts[1].getBytes(StandardCharsets.UTF_8));
             byte[] hash = 
Base64.decodeBase64(parts[2].getBytes(StandardCharsets.UTF_8));
 
             PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 
iterations, hash.length * 8);