Crypt
Monthly
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller invokes info_as_hash() on a crafted PKCS#12 file containing a zero-length BMPSTRING bag attribute. The root cause is a zero-size Renew() call that Perl's memory allocator implements as a free() returning NULL, which is subsequently dereferenced inside strlen() within a call to newSVpvn(). With no public exploit identified at time of analysis and an EPSS of 0.19%, active exploitation is currently unlikely, though any service that parses attacker-supplied PKCS#12 data and calls info_as_hash() is directly exposed to denial of service.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password hashes by seeding salts with Perl's built-in rand() function, which is not cryptographically secure. An attacker who obtains a password hash database can more easily precompute or predict salts, reducing the cost of offline cracking. There is no public exploit identified at time of analysis, EPSS is low (0.14%, 4th percentile), and CISA SSVC records no observed exploitation.
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a stored password hash because check_password compares values with Perl's short-circuiting eq operator instead of a constant-time comparison. The flaw is classic CWE-208 (Observable Timing Discrepancy); it carries a CVSS 7.5 but a very low EPSS (0.14%, 4th percentile) and no public exploit identified at time of analysis, and SSVC records exploitation status as none. A vendor patch is available.
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate leak adjacent heap memory to an application that enumerates certificate extensions. When code calls extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid(), a certificate extension whose textual OID exceeds the fixed 129-byte buffer causes the returned hash key to include bytes read past the allocation, exposing process memory and risking a crash. No public exploit is identified at time of analysis and it is not in CISA KEV, but the fix is confirmed in release 2.1.3 and the flaw is trivially triggerable by any attacker who can supply a certificate.
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl process that parses it. Four helper functions (basicC, ia5string, auth_att, keyid_data) dereference NULL pointers returned by OpenSSL's X509V3_EXT_d2i() on unparseable extensions - and keyid_data/auth_att additionally deref an akid->keyid field that is legitimately NULL for an empty Authority Key Identifier (DER 30 00). There is no public exploit identified at time of analysis, but the fix commit and a clear crash mechanism are published; CVSS is 7.5 (availability-only).
Private-key recovery in the Crypt::DSA Perl module (all versions before 1.22) stems from a biased random number generator that forces the high bit of every value returned by Crypt::DSA::Util::makerandom, making both the DSA signing nonce and the private key non-uniform. An attacker who obtains the public key plus a modest number of signatures produced under an affected key can reconstruct the private key using a lattice attack. There is no public exploit identified at time of analysis, but the underlying nonce-bias lattice technique is well documented and EPSS remains low at 0.21%.
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak adjacent process heap memory into Perl scalars when its attributes are printed. Because print_attribute() copies a UTF8STRING value with strncpy into a buffer sized to the exact declared length and never NUL-terminates it, downstream strlen()/newSVpvn() reads past the buffer end. No public exploit identified at time of analysis, EPSS is low (0.35%), and it is not on CISA KEV, but the SSVC framework flags it as automatable with partial technical impact.
Predictable salt generation in the Perl Crypt::PBKDF2 module before version 0.261630 weakens the cryptographic strength of derived password hashes. The module uses Perl's built-in rand() function - a non-cryptographic PRNG - to generate salt values, making salts guessable and enabling precomputation attacks against stored password hashes. No public exploit identified at time of analysis, but a vendor patch is available and the issue was responsibly disclosed by CPANSec.
Weak salt generation in Crypt::PasswdMD5 (Perl) through version 1.42 enables password hash cracking via predictable random values. The module uses Perl's built-in rand() function for salt generation instead of cryptographically secure random sources, allowing attackers to predict salt values and drastically reduce the computational cost of offline password cracking attacks. CVSS 7.5 (High) with network vector and no authentication required. SSVC assessment indicates the vulnerability is automatable with partial technical impact. EPSS and KEV data not provided, but the cryptographic weakness is architecturally exploitable wherever these password hashes are transmitted or stored in accessible locations.
Secret-recovery via timing side channel in the Perl module Crypt::SecretBuffer before 0.019 lets remote attackers infer stored secrets by measuring response-time discrepancies during comparison operations. When an application uses SecretBuffer to hold and compare sensitive values such as plaintext passwords, the non-constant-time comparison leaks information that can be used to guess the secret byte-by-byte. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and SSVC records exploitation as none, so this is a real but low-urgency defense-in-depth fix rather than an actively exploited threat.
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation, and bin2hex functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. [CVSS 7.5 HIGH]
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could weaken security guarantees.
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length parameter validation bypass in the random_bytes() function. When negative values are passed to the function, integer wraparound causes incorrect memory allocation and unbounded writes to heap memory, triggering application crashes. Exploitation requires attacker control over the length argument, which in typical usage is hardcoded, limiting practical attack scenarios.
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts a size_t to int, causing overflow that could compromise cryptographic operations.
Heap buffer overflow in Perl's Crypt::URandom module (versions 0.41-0.54) allows denial of service through integer wraparound when negative length values are passed to the crypt_urandom_getrandom() XS function, causing heap corruption and application crashes. The vulnerability requires direct control over the length parameter, limiting real-world exploitability in typical usage scenarios where this value is hardcoded. No patch is currently available for affected users.
Crypt::PBKDF2 for Perl prior to version 0.261630 ships with critically weak password-hashing defaults - HMAC-SHA1 as the pseudorandom function and only 1,000 iterations - leaving derived keys and stored passwords highly vulnerable to offline brute-force attacks. Applications that do not explicitly override these defaults expose any compromised credential store to cracking at rates orders of magnitude faster than OWASP-recommended configurations (220,000-1,400,000 iterations depending on algorithm). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the structural nature of CWE-916 means all previously generated hashes using the weak defaults remain exploitable even after upgrading the library unless proactively rehashed.
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
File overwrite and information disclosure in Crypt::DSA through version 1.19 for Perl expose systems where user-controlled input reaches the library's key handling routines. The root cause is use of Perl's 2-argument open() form in lib/Crypt/DSA/Key.pm, which interprets leading or trailing special characters in filenames as I/O mode specifiers, enabling reads from or writes to arbitrary files. CVSS rates this AV:N/AC:L/PR:N/UI:N (Medium, 6.5), though actual exposure depends on application-level code paths; EPSS is 0.01% and this CVE is not in CISA KEV, indicating no public exploit identified at time of analysis.
Heap out-of-bounds read in Crypt::Argon2 for Perl (versions 0.017 through 0.030) exposes applications to process crash or heap memory leakage when argon2_verify is called with an empty encoded hash string. The defect is a size_t integer underflow: the auto-detect variant of argon2_verify subtracts 1 from encoded_len without a zero-check, wrapping to SIZE_MAX and causing memchr to scan up to SIZE_MAX bytes of adjacent heap memory. No public exploit has been identified and no CISA KEV listing exists; EPSS is 0.03% (9th percentile), consistent with the SSVC assessment of exploitation status 'none'.
Crypt::Sodium::XS for Perl bundles a vulnerable version of libsodium (<= 1.0.20) that has a signature verification flaw. In atypical use cases with custom cryptography, this can compromise data authenticity guarantees. Patch available.
Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller invokes info_as_hash() on a crafted PKCS#12 file containing a zero-length BMPSTRING bag attribute. The root cause is a zero-size Renew() call that Perl's memory allocator implements as a free() returning NULL, which is subsequently dereferenced inside strlen() within a call to newSVpvn(). With no public exploit identified at time of analysis and an EPSS of 0.19%, active exploitation is currently unlikely, though any service that parses attacker-supplied PKCS#12 data and calls info_as_hash() is directly exposed to denial of service.
Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password hashes by seeding salts with Perl's built-in rand() function, which is not cryptographically secure. An attacker who obtains a password hash database can more easily precompute or predict salts, reducing the cost of offline cracking. There is no public exploit identified at time of analysis, EPSS is low (0.14%, 4th percentile), and CISA SSVC records no observed exploitation.
Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a stored password hash because check_password compares values with Perl's short-circuiting eq operator instead of a constant-time comparison. The flaw is classic CWE-208 (Observable Timing Discrepancy); it carries a CVSS 7.5 but a very low EPSS (0.14%, 4th percentile) and no public exploit identified at time of analysis, and SSVC records exploitation status as none. A vendor patch is available.
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate leak adjacent heap memory to an application that enumerates certificate extensions. When code calls extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid(), a certificate extension whose textual OID exceeds the fixed 129-byte buffer causes the returned hash key to include bytes read past the allocation, exposing process memory and risking a crash. No public exploit is identified at time of analysis and it is not in CISA KEV, but the fix is confirmed in release 2.1.3 and the flaw is trivially triggerable by any attacker who can supply a certificate.
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl process that parses it. Four helper functions (basicC, ia5string, auth_att, keyid_data) dereference NULL pointers returned by OpenSSL's X509V3_EXT_d2i() on unparseable extensions - and keyid_data/auth_att additionally deref an akid->keyid field that is legitimately NULL for an empty Authority Key Identifier (DER 30 00). There is no public exploit identified at time of analysis, but the fix commit and a clear crash mechanism are published; CVSS is 7.5 (availability-only).
Private-key recovery in the Crypt::DSA Perl module (all versions before 1.22) stems from a biased random number generator that forces the high bit of every value returned by Crypt::DSA::Util::makerandom, making both the DSA signing nonce and the private key non-uniform. An attacker who obtains the public key plus a modest number of signatures produced under an affected key can reconstruct the private key using a lattice attack. There is no public exploit identified at time of analysis, but the underlying nonce-bias lattice technique is well documented and EPSS remains low at 0.21%.
Heap out-of-bounds read in the Perl module Crypt::OpenSSL::PKCS12 before version 1.96 lets a crafted PKCS#12 file leak adjacent process heap memory into Perl scalars when its attributes are printed. Because print_attribute() copies a UTF8STRING value with strncpy into a buffer sized to the exact declared length and never NUL-terminates it, downstream strlen()/newSVpvn() reads past the buffer end. No public exploit identified at time of analysis, EPSS is low (0.35%), and it is not on CISA KEV, but the SSVC framework flags it as automatable with partial technical impact.
Predictable salt generation in the Perl Crypt::PBKDF2 module before version 0.261630 weakens the cryptographic strength of derived password hashes. The module uses Perl's built-in rand() function - a non-cryptographic PRNG - to generate salt values, making salts guessable and enabling precomputation attacks against stored password hashes. No public exploit identified at time of analysis, but a vendor patch is available and the issue was responsibly disclosed by CPANSec.
Weak salt generation in Crypt::PasswdMD5 (Perl) through version 1.42 enables password hash cracking via predictable random values. The module uses Perl's built-in rand() function for salt generation instead of cryptographically secure random sources, allowing attackers to predict salt values and drastically reduce the computational cost of offline password cracking attacks. CVSS 7.5 (High) with network vector and no authentication required. SSVC assessment indicates the vulnerability is automatable with partial technical impact. EPSS and KEV data not provided, but the cryptographic weakness is architecturally exploitable wherever these password hashes are transmitted or stored in accessible locations.
Secret-recovery via timing side channel in the Perl module Crypt::SecretBuffer before 0.019 lets remote attackers infer stored secrets by measuring response-time discrepancies during comparison operations. When an application uses SecretBuffer to hold and compare sensitive values such as plaintext passwords, the non-constant-time comparison leaks information that can be used to guess the secret byte-by-byte. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and SSVC records exploitation as none, so this is a real but low-urgency defense-in-depth fix rather than an actively exploited threat.
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation, and bin2hex functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. [CVSS 7.5 HIGH]
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could weaken security guarantees.
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length parameter validation bypass in the random_bytes() function. When negative values are passed to the function, integer wraparound causes incorrect memory allocation and unbounded writes to heap memory, triggering application crashes. Exploitation requires attacker control over the length argument, which in typical usage is hardcoded, limiting practical attack scenarios.
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts a size_t to int, causing overflow that could compromise cryptographic operations.
Heap buffer overflow in Perl's Crypt::URandom module (versions 0.41-0.54) allows denial of service through integer wraparound when negative length values are passed to the crypt_urandom_getrandom() XS function, causing heap corruption and application crashes. The vulnerability requires direct control over the length parameter, limiting real-world exploitability in typical usage scenarios where this value is hardcoded. No patch is currently available for affected users.
Crypt::PBKDF2 for Perl prior to version 0.261630 ships with critically weak password-hashing defaults - HMAC-SHA1 as the pseudorandom function and only 1,000 iterations - leaving derived keys and stored passwords highly vulnerable to offline brute-force attacks. Applications that do not explicitly override these defaults expose any compromised credential store to cracking at rates orders of magnitude faster than OWASP-recommended configurations (220,000-1,400,000 iterations depending on algorithm). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the structural nature of CWE-916 means all previously generated hashes using the weak defaults remain exploitable even after upgrading the library unless proactively rehashed.
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
File overwrite and information disclosure in Crypt::DSA through version 1.19 for Perl expose systems where user-controlled input reaches the library's key handling routines. The root cause is use of Perl's 2-argument open() form in lib/Crypt/DSA/Key.pm, which interprets leading or trailing special characters in filenames as I/O mode specifiers, enabling reads from or writes to arbitrary files. CVSS rates this AV:N/AC:L/PR:N/UI:N (Medium, 6.5), though actual exposure depends on application-level code paths; EPSS is 0.01% and this CVE is not in CISA KEV, indicating no public exploit identified at time of analysis.
Heap out-of-bounds read in Crypt::Argon2 for Perl (versions 0.017 through 0.030) exposes applications to process crash or heap memory leakage when argon2_verify is called with an empty encoded hash string. The defect is a size_t integer underflow: the auto-detect variant of argon2_verify subtracts 1 from encoded_len without a zero-check, wrapping to SIZE_MAX and causing memchr to scan up to SIZE_MAX bytes of adjacent heap memory. No public exploit has been identified and no CISA KEV listing exists; EPSS is 0.03% (9th percentile), consistent with the SSVC assessment of exploitation status 'none'.
Crypt::Sodium::XS for Perl bundles a vulnerable version of libsodium (<= 1.0.20) that has a signature verification flaw. In atypical use cases with custom cryptography, this can compromise data authenticity guarantees. Patch available.
Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.