========================================================================
CVE-2017-20240                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2017-20240
   Distribution:  Crypt-PBKDF2
       Versions:  before 0.261630

       MetaCPAN:  https://metacpan.org/dist/Crypt-PBKDF2
       VCS Repo:  https://github.com/arodland/Crypt-PBKDF2

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to
timing attacks

Description
-----------
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to
timing attacks.

These versions use Perl's built-in eq comparison. Discrepancies in
timing could be used to guess the underlying derived-key.

Problem types
-------------
- CWE-208 Observable Timing Discrepancy

Workarounds
-----------
Apply the patch from the referenced pull request.

Solutions
---------
Upgrade to version 0.261630 or later.

References
----------
https://github.com/arodland/Crypt-PBKDF2/pull/6
https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.161520/source/lib/Crypt/PBKDF2.pm#L123-148
https://metacpan.org/release/ARODLAND/Crypt-PBKDF2-0.261630/changes

Timeline
--------
- 2017-12-11: Issue reported as pull request
- 2026-06-11: Version 0.261630 released with a fix