CVE-2017-20240

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks

5.9 MediumFix available

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks.

These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.32%Up 0.3 points since Jun 13, 2026

What each source reports

CVE List Score used 5.9

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks.

These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

Record: CVE-2017-20240
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

EUVDEUVD-2017-18978 5.9

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks.

These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

Record: EUVD-2017-18978
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-m538-6wp4-7h22 5.9

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions...

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks.

These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

Record: GHSA-m538-6wp4-7h22
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

NVD 5.9

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks.

These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

Record: CVE-2017-20240
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

OSV 5.9

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks.

These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

Record: CVE-2017-20240
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-20240 5.9

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

Record: DEBIAN-CVE-2017-20240
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-20240 5.9

Record: UBUNTU-CVE-2017-20240
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11034-1 No score

perl-Crypt-PBKDF2-0.261630-1.1 on GA media

These are all security issues fixed in the perl-Crypt-PBKDF2-0.261630-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11034-1
Updated: 2026-11-02

Affected products

arodland crypt::pbkdf2

Affected packages

Affected packages
Package	Affected	Fixed
`libcrypt-pbkdf2-perl` Debian:12	before 0.261630-1~deb13u1~deb12u1, plus listed versions 0.161520-2	0.261630-1~deb13u1~deb12u1
`libcrypt-pbkdf2-perl` Debian:13	before 0.261630-1~deb13u1, plus listed versions 0.161520-20.261630-1~deb13u1~deb12u1	0.261630-1~deb13u1
`libcrypt-pbkdf2-perl` Debian:14	before 0.261630-1, plus listed versions 0.161520-20.261630-1~deb13u10.261630-1~deb13u1~deb12u1	0.261630-1
`libcrypt-pbkdf2-perl` Ubuntu:16.04:LTS	All versions, plus listed versions 0.150900-10.160410-1	None known
`libcrypt-pbkdf2-perl` Ubuntu:18.04:LTS	All versions, plus listed versions 0.161520-1	None known
`libcrypt-pbkdf2-perl` Ubuntu:20.04:LTS	All versions, plus listed versions 0.161520-1	None known
`libcrypt-pbkdf2-perl` Ubuntu:22.04:LTS	All versions, plus listed versions 0.161520-1	None known
`libcrypt-pbkdf2-perl` Ubuntu:24.04:LTS	All versions, plus listed versions 0.161520-2	None known
`libcrypt-pbkdf2-perl` Ubuntu:25.10	All versions, plus listed versions 0.161520-2	None known
`libcrypt-pbkdf2-perl` Ubuntu:26.10	All versions, plus listed versions 0.161520-20.261630-1	None known
`libcrypt-pbkdf2-perl` Ubuntu:26.04:LTS	All versions, plus listed versions 0.161520-2	None known
`perl-Crypt-PBKDF2` openSUSE:Tumbleweed From an advisory covering 3 CVEs	before 0.261630-1.1	0.261630-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-20240 is a medium vulnerability (CVSS 5.9) in Arodland Crypt::pbkdf2, published June 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in libcrypt-pbkdf2-perl 0.261630-1~deb13u1~deb12u1.

References

Show 7 moreShow less