Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts
No sign of exploitation. No public exploitation artifact known so far.
Crypt::SaltedHash for Perl versions up to 0.09 uses a predictable random number generator for creating password salts, making it easy for attackers to crack hashed passwords. This is a critical flaw because salts are supposed to be unpredictable to protect passwords.
The module relies on Perl's built-in rand() function, which is a weak pseudorandom number generator unsuitable for cryptographic operations. An attacker can predict salt values and precompute rainbow tables or perform efficient brute-force attacks against hashed passwords, bypassing the security benefit of salting. Affected versions prior to 0.10 fail to use cryptographically secure random sources such as /dev/urandom or CSPRNG libraries.