Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks

Crypt::SaltedHash versions up to 0.09 use a comparison method that takes slightly different times depending on when characters match, allowing attackers to guess the password hash through timing analysis.

The library employs Perl's standard eq operator for hash comparison, which exhibits variable execution time based on string matching positions. An attacker can measure response times across multiple attempts to infer the correct hash value byte-by-byte, bypassing the salt's protective mechanism.