CVE-2017-20240 Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks
MediumCVSS 5.9
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks.
These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcrypt-pbkdf2-perl(Debian:12) | < 0.261630-1~deb13u1~deb12u1 | 0.261630-1~deb13u1~deb12u1 |
| debian/libcrypt-pbkdf2-perl(Debian:12) | = 0.161520-2 | No fix listed |
| debian/libcrypt-pbkdf2-perl(Debian:13) | < 0.261630-1~deb13u1 | 0.261630-1~deb13u1 |
| debian/libcrypt-pbkdf2-perl(Debian:13) | = 0.161520-2 | No fix listed |
| debian/libcrypt-pbkdf2-perl(Debian:13) | = 0.261630-1~deb13u1~deb12u1 | No fix listed |
| debian/libcrypt-pbkdf2-perl(Debian:14) | < 0.261630-1 | 0.261630-1 |
| debian/libcrypt-pbkdf2-perl(Debian:14) | = 0.161520-2 | No fix listed |
| debian/libcrypt-pbkdf2-perl(Debian:14) | = 0.261630-1~deb13u1 | No fix listed |
| debian/libcrypt-pbkdf2-perl(Debian:14) | = 0.261630-1~deb13u1~deb12u1 | No fix listed |
| ubuntu/libcrypt-pbkdf2-perl(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libcrypt-pbkdf2-perl(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libcrypt-pbkdf2-perl(Ubuntu:26.10) | All versions | No fix listed |
| ARODLAND Crypt::PBKDF2 | < 0.261630 | 0.261630 |
| ubuntu/libcrypt-pbkdf2-perl(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2017-20240 vendor-advisory
- github.com issue-tracking
- metacpan.org
- metacpan.org release-notes
- www.openwall.com
- bugs.debian.org issue-tracking