Description (CNA)
Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ARODLAND / Crypt::PBKDF2 | affected 0 before 0.261630 |
CWE
CWE-916
References
- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
- https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.