Описание
Security update for perl-Crypt-SaltedHash
This update for perl-Crypt-SaltedHash fixes the following issues:
Changes in perl-Crypt-SaltedHash:
updated to 0.110.0 (0.11)
-
0.11 2026-05-20 14:05:07+01:00 Europe/London
- Fixed metadata
- Moved author tests into xt
-
0.10 2026-05-19
- Maintenance taken over by Robert Rothenberg perl@rhizomnic.com
- Updated the Git Repository
- Updated copyright year
- Minimum Perl version is v5.6.0
- Added missing prerequisites, fixes RT#116392
- Security: Use system randomness source to generate the salt CVE-2026-47372 bsc#1265927
- Security: Use constant-time comparison of hashes CVE-2026-47373 bsc#1265912
- Deprecated module
- Updated README
Список пакетов
openSUSE Leap 16.0
perl-Crypt-SaltedHash-0.110.0-bp160.1.1
perl-Crypt-SysRandom-0.7.0-bp160.1.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1265912
- SUSE Bug 1265927
- SUSE CVE CVE-2026-47372 page
- SUSE CVE CVE-2026-47373 page
Описание
Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
Затронутые продукты
openSUSE Leap 16.0:perl-Crypt-SaltedHash-0.110.0-bp160.1.1
openSUSE Leap 16.0:perl-Crypt-SysRandom-0.7.0-bp160.1.1
Ссылки
- CVE-2026-47372
- SUSE Bug 1265927
Описание
Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash.
Затронутые продукты
openSUSE Leap 16.0:perl-Crypt-SaltedHash-0.110.0-bp160.1.1
openSUSE Leap 16.0:perl-Crypt-SysRandom-0.7.0-bp160.1.1
Ссылки
- CVE-2026-47373
- SUSE Bug 1265912