EUVD-2026-45895
GHSA-vhqp-3rvr-75rx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weak salts only aid offline cracking after an attacker already holds the hashes, so AV:L, AC:H and PR:L; limited confidentiality gain (C:L) with no integrity or availability impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Crypt::Password versions through 0.28 for Perl generate insecure random values for salts.
These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
AnalysisAI
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password hashes by seeding salts with Perl's built-in rand() function, which is not cryptographically secure. An attacker who obtains a password hash database can more easily precompute or predict salts, reducing the cost of offline cracking. There is no public exploit identified at time of analysis, EPSS is low (0.14%, 4th percentile), and CISA SSVC records no observed exploitation.
Technical ContextAI
Crypt::Password is a Perl CPAN module (author DRSTEVE) that wraps the system crypt() facility to hash and verify passwords, generating a per-password salt for algorithms such as SHA-crypt. The root cause is CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator): the affected code path (lib/Crypt/Password.pm, lines ~306-309 per the MetaCPAN reference) derives salt bytes from Perl's rand(), a non-cryptographic PRNG whose output is deterministic given knowledge of, or ability to reconstruct, its seed. Because rand() is designed for statistical randomness rather than unpredictability, salts produced this way are guessable, undermining the salt's purpose of defeating precomputation (rainbow-table) attacks and de-duplicating identical passwords across a hash store.
RemediationAI
Patch available per vendor advisory: upgrade Crypt::Password to a release later than 0.28 that replaces rand() with a cryptographically secure source; an exact fixed version number is not confirmed in the available data, so pull the latest release from CPAN/MetaCPAN and confirm the salt-generation code (lib/Crypt/Password.pm ~L306-309) no longer calls rand(). Debian users should update via the tracked distribution packages once fixed builds land. As a compensating control until patched, avoid relying on this module's built-in salt for new hashes - generate salts from a CSPRNG (e.g. Crypt::URandom / /dev/urandom or Bytes::Random::Secure) and pass them in, and force re-hashing of stored credentials on next login so predictable-salt hashes are retired; the trade-off is application code changes and a credential-migration window. Consult the disclosure threads at https://seclists.org/oss-sec/2026/q3/175 and http://www.openwall.com/lists/oss-security/2026/07/20/3 for coordination details.
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could wea
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak a
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts
Private-key recovery in the Crypt::DSA Perl module (all versions before 1.22) stems from a biased random number generato
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length param
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined
Secret-recovery via timing side channel in the Perl module Crypt::SecretBuffer before 0.019 lets remote attackers infer
Weak salt generation in Crypt::PasswdMD5 (Perl) through version 1.42 enables password hash cracking via predictable rand
Same technique Information Disclosure
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| forky, sid | vulnerable | 0.28-2 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today