--- title: "TYPO3-PSA-2019-009: Truncated passwords during authentication process on typo3.org services" url: "https://news.typo3.com/security/advisory/typo3-psa-2019-009" description: It has been discovered that passwords were truncated during authentication process on typo3.org services. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Showcase & Success" - Public Service Announcement --- # TYPO3-PSA-2019-009: Truncated passwords during authentication process on typo3.org services - [Showcase & Success](https://news.typo3.com/article/category/showcase-success) - Security / [Public Service Announcement](https://news.typo3.com/article/category/security/public-service-announcement) TYPO3-PSA-2019-009: Truncated passwords during authentication process on typo3.org services =========================================================================================== 30 October 2019 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that passwords were truncated during authentication process on typo3.org services. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b8266fdc667b773926c59081862ab148.jpeg)[Oliver Hader](https://news.typo3.com/article/author/oliver-hader) - **Release Date:** October 30, 2019 - **Component Type:** LDAP passwort storage & authentication (via [my.typo3.org](https://my.typo3.org/)) - **Impact:** Truncated password during authentication - **Serverity:** critical - **Suggested CVSS v3:** [AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L/E:F/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L/E:F/RL:O/RC:C) - **CWE:** [CWE-327](https://cwe.mitre.org/data/definitions/327.html) ### Problem Description Passwords of users on my.typo3.org - the management hub that is used to authenticate against multiple other typo3.org related services and tools - were stored using a broken cryptographic algorithm. Traditional *CRYPT-DES* has been used to generate a cryptographic hash of the plaintext password - due to the limitation on traditional *DES*, only the first eight characters of the password were used. As a result, the first eight characters were sufficient to log in at my.typo3.org - even if the initial password was much longer. In case this sequence would have contained weak or guessable phrases - the potential of dictionary-based attacks was much higher to be successful. For instance, "*password*" would have been enough even if the actual plaintext password was "*password%faH3!ieXees.h1iK*". In total three different hashing algorithms *CRYPT-DES*, *MD5* and *SHA1* had been applied and stored. The following platforms were affected: - typo3.org - forge.typo3.org - review.typo3.org - git-t3o.typo3.org - talk.typo3.org - decisions.typo3.org - extensions.typo3.org - wiki.typo3.org - crm.typo3.com - typo3.com (partner network) ###   ### Solution Broken *CRYPT-DES* algorithm has been disabled and corresponding hashes removed from LDAP password storage. All the above systems have now been converted to state of the art password hashing algorithm *CRYPT-SHA-512* and a minimum password length of 12 characters, see  for implementation details. Audits controls done by the maintainers of the platforms mentioned above have shown, that we have no reason to believe that this vulnerability has been unlawfully exploited. ### Suggested Actions **As a precaution, we ask you to change your TYPO3.org password.** - login at  - change password at  - logout As an alternative, you can reset your password via the [forgot password](https://my.typo3.org/registration/reset-password?tx_felogin_pi1%5Bforgot%5D=1) option. ### Credits Thanks to TYPO3 framework merger Frank Nägler who reported this issue. ### Final note Users having a TYPO3.org account have been informed already on October 28, 2019, on behalf of the TYPO3 Association. This public service announcement published by the TYPO3 security team aims to respond to questions we received to provide more technical insights into the original vulnerability and how it has been addressed in a collaborative effort among involved TYPO3 teams. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/cc7cba9757f98fbe05023a139119df74.jpeg) About the Author [Oliver Hader](https://news.typo3.com/article/author/oliver-hader) Core Developer at TYPO3 GmbH,Hof, Germany [Website](https://typo3.com)[Twitter](https://twitter.com/ohader)[LinkedIn](https://www.linkedin.com/in/oliverhader/)[Xing](https://www.xing.com/profile/Oliver_Hader) Oliver started to work with TYPO3 in 2005 and was fascinated by the product and its universe. Since 2007 he is member of the TYPO3 Core Team. After going back to university in 2014 for achieving a postgraduate master degree in internet web science, he is now researching on advanced web technology topics in general and for TYPO3 in particular. In his spare time, Oliver loves to go cycling cross-country in the uplands around Hof (Germany) in northern Bavaria - at the region where he's living as well. [More posts by this author](https://news.typo3.com/article/author/oliver-hader)