EUVD-2026-28809
GHSA-j539-xxc6-73wf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.
The built-in rand function is predictable, and unsuitable for cryptography.
AnalysisAI
Weak salt generation in Crypt::PasswdMD5 (Perl) through version 1.42 enables password hash cracking via predictable random values. The module uses Perl's built-in rand() function for salt generation instead of cryptographically secure random sources, allowing attackers to predict salt values and drastically reduce the computational cost of offline password cracking attacks. CVSS 7.5 (High) with network vector and no authentication required. SSVC assessment indicates the vulnerability is automatable with partial technical impact. EPSS and KEV data not provided, but the cryptographic weakness is architecturally exploitable wherever these password hashes are transmitted or stored in accessible locations.
Technical ContextAI
Crypt::PasswdMD5 is a Perl module implementing MD5-based Unix password hashing (crypt format). The vulnerability stems from CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). The module's salt generation routine uses Perl's rand() function, which implements a predictable linear congruential generator (LCG) unsuitable for security purposes. Cryptographic salts must be generated from secure random sources (like /dev/urandom or Crypt::Random) to ensure each password hash has sufficient entropy. Predictable salts allow attackers to precompute rainbow tables or significantly reduce the search space for brute-force attacks. The CPE identifier (cpe:2.3:a:rsavage:crypt::passwdmd5) confirms this affects Ron Savage's implementation. Source code reference points to lines 35-47 of PasswdMD5.pm where the insecure rand() call occurs.
RemediationAI
Upgrade to Crypt::PasswdMD5 version 1.43 or later when available (patch status not confirmed in provided data - verify current release version at https://metacpan.org/release/RSAVAGE/Crypt-PasswdMD5). If patched version is not yet released, implement immediate compensating controls: (1) Replace Crypt::PasswdMD5 with secure alternatives like Crypt::Bcrypt, Crypt::Argon2, or Authen::Passphrase which use cryptographically secure random sources and modern KDFs. This is the recommended long-term solution as MD5-based password hashing is itself deprecated. (2) If replacement is not immediately feasible, manually patch the salt generation code at lines 35-47 of PasswdMD5.pm to use Crypt::Random or reading from /dev/urandom instead of rand(). Trade-off: requires code modification and testing. (3) Force re-hashing of all existing passwords with secure implementation upon next user authentication. (4) Implement additional hash exposure controls: encrypt password databases at rest, use TLS for all authentication traffic, restrict database access with principle of least privilege, enable database access logging. Monitor for unusual password hash access patterns. Review oss-security mailing list discussion at http://www.openwall.com/lists/oss-security/2026/05/08/17 for community-developed patches and migration guidance.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password has
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could wea
Crypt::Sodium::XS for Perl bundles a vulnerable version of libsodium (<= 1.0.20) that has a signature verification flaw.
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak a
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts
Private-key recovery in the Crypt::DSA Perl module (all versions before 1.22) stems from a biased random number generato
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length param
Heap buffer overflow in Perl's Crypt::URandom module (versions 0.41-0.54) allows denial of service through integer wrapa
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today