Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.4%
exploitation probability
0.4%top 68% of all CVEs
observed exploitation
nono source reports it
In short
Crypt::SaltedHash versions up to 0.09 use a comparison method that takes slightly different times depending on when characters match, allowing attackers to guess the password hash through timing analysis.
Technical detail
The library employs Perl's standard eq operator for hash comparison, which exhibits variable execution time based on string matching positions. An attacker can measure response times across multiple attempts to infer the correct hash value byte-by-byte, bypassing the salt's protective mechanism.
Summary generated and translated by AI from the official description.
Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks.
These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
RRWO · Crypt::SaltedHash