medium5.9
CVE-2017-20240
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks.
Impact
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.
Affected products
| Product | Affected versions |
|---|---|
| Crypt::PBKDF2 | before 0.261630 |
Versions were read from the advisory text. No structured product data has been published for this record yet.