Описание
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libcrypt-pbkdf2-perl | fixed | 0.261630-1 | package | |
| libcrypt-pbkdf2-perl | fixed | 0.261630-1~deb13u1 | trixie | package |
| libcrypt-pbkdf2-perl | fixed | 0.261630-1~deb13u1~deb12u1 | bookworm | package |
Примечания
https://lists.security.metacpan.org/cve-announce/msg/40929601/
Fixed by: https://github.com/arodland/Crypt-PBKDF2/commit/ac5aac7c8c0e411165a6665a9c1f449b745f2629 (0.261630)
Связанные уязвимости
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.