[Security] limited the password length passed to encoders
updated CHANGELOG for 2.0.25
updated VERSION for 2.0.25