Skip to content

Prevent 500 errors on FIPS systems when user password is too short

What does this MR do and why?

On Ubuntu 22.04 FIPS system, attempting to hash a password less than 8 characters results in:

OpenSSL::KDF::KDFError (PKCS5_PBKDF2_HMAC: invalid key length)

Previously the password length was only checked in a Devise validator, but this is too late for OpenSSL. Fix this by doing this check in Users::UpdateService.

Relates to https://gitlab.com/gitlab-com/request-for-help/-/issues/3526

References

Screenshots or screen recordings

image

How to set up and validate locally

  1. Install Ubuntu 22.04 Pro FIPS system.
  2. Install GitLab.
  3. Attempt to change a password.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Stan Hu

Merge request reports

Loading