Cloak Ecto
Monthly
Insufficient password-hashing work factor in the Cloak.Ecto PBKDF2 field module causes hashes to be derived with roughly 18,750 times less computational effort than the configured parameters imply, letting anyone who already holds both the stored hash values and the configured :secret brute-force low-entropy plaintexts (such as email addresses) far more cheaply than the library promises. The affected code is cloak_ecto from 1.0.0-alpha.0 onward and cloak from 0.7.0 before 1.0.0-alpha.0; the vulnerable dump/1 callback passes config[:size] (default 32) into PBKDF2's iteration-count position, so each hash runs 32 rounds instead of the default 600,000. This is a post-compromise amplifier rather than a standalone remote exploit: it requires prior disclosure of the hash column and the application secret, and remains impractical against high-entropy values. No public exploit code was identified at time of analysis, and CISA KEV does not list this CVE; the CNA assigned CVSS 4.0 base 6.3 (medium), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, reflecting the privileged prerequisites and confidentiality-only impact.
Insufficient password-hashing work factor in the Cloak.Ecto PBKDF2 field module causes hashes to be derived with roughly 18,750 times less computational effort than the configured parameters imply, letting anyone who already holds both the stored hash values and the configured :secret brute-force low-entropy plaintexts (such as email addresses) far more cheaply than the library promises. The affected code is cloak_ecto from 1.0.0-alpha.0 onward and cloak from 0.7.0 before 1.0.0-alpha.0; the vulnerable dump/1 callback passes config[:size] (default 32) into PBKDF2's iteration-count position, so each hash runs 32 rounds instead of the default 600,000. This is a post-compromise amplifier rather than a standalone remote exploit: it requires prior disclosure of the hash column and the application secret, and remains impractical against high-entropy values. No public exploit code was identified at time of analysis, and CISA KEV does not list this CVE; the CNA assigned CVSS 4.0 base 6.3 (medium), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, reflecting the privileged prerequisites and confidentiality-only impact.