CVE-2017-20240 PUBLISHED

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks

Assigner: CPANSec
Reserved: 26.05.2026 Published: 12.06.2026 Updated: 12.06.2026

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks.

These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

Product Status

Vendor ARODLAND
Product Crypt::PBKDF2
Versions Default: unaffected
  • affected from 0 to 0.261630 (excl.)

Workarounds

Apply the patch from the referenced pull request.

Solutions

Upgrade to version 0.261630 or later.

References

Problem Types

  • CWE-208 Observable Timing Discrepancy CWE