X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/4152dca09e6a7d9b0da81cb5ac6f76e8f05d2a23..10205503757cb7dc1113873b4825847dc5753b92:/doc/security.mdwn?ds=sidebyside

diff --git a/doc/security.mdwn b/doc/security.mdwn
index b3af3db3e..57cac719f 100644
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -390,10 +390,20 @@ pre-emtively guard against that, current versions of ikiwiki store password
 hashes (using Eksblowfish).
 
 If you use the [[plugins/passwordauth]] plugin, I recommend upgrading to
-ikiwiki 2.48, installing the [[Authen::Passphrase]] perl module, and running
+ikiwiki 2.48, installing the [[cpan Authen::Passphrase]] perl module, and running
 `ikiwiki-transition hashpassword` to replace all existing cleartext passwords
 with strong blowfish hashes. 
 
 You might also consider changing to [[plugins/openid]], which does not 
 require ikiwiki deal with passwords at all, and does not involve users sending
 passwords in cleartext over the net to log in, either.
+
+## Empty password security hole
+
+This hole allowed ikiwiki to accept logins using empty passwords, to openid
+accounts that didn't use a password. It was introduced in version 1.34, and
+fixed in version 2.48. The [bug](http://bugs.debian.org/483770) was
+discovered on 30 May 2008 and fixed the same day. ([[cve CVE-2008-0169]])
+
+I recommend upgrading to 2.48 immediatly if your wiki allows both password
+and openid logins.