CVE-2017-20240mediumCWE-208

CVE-2017-20240: falha de média gravidade em ARODLAND Crypt::PBKDF2

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks

Publicada em

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.9epss 0.3%
probabilidade de exploração
0.3%top 77% das CVEs
exploração observada
nãonenhuma fonte reporta
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
ARODLAND · Crypt::PBKDF2
CVEs relacionadas — ARODLAND Crypt::PBKDF2

No mesmo produto, das mais perigosas para as menos.

CVE-2026-9638HIGHCrypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for saltsEPSS 0.5%CVE-2026-9641MEDIUMCrypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterationsEPSS 0.3%
Referências
https://github.com/arodland/Crypt-PBKDF2/pull/6https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.161520/source/lib/Crypt/PBKDF2.pm#L123-148https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changeshttp://www.openwall.com/lists/oss-security/2026/06/12/3