Description (CNA)
Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| DRSTEVE / Crypt::Password | affected 0 through 0.28 |
CWE
CWE-208
References
- https://metacpan.org/release/DRSTEVE/Crypt-Password-0.28/source/lib/Crypt/Password.pm#L190-193
- https://rt.cpan.org/Ticket/Display.html?id=180162
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.