Perl Catalyst::Plugin::Authentication legacy password check leaks passwords through timing
A Perl website login module lets attackers guess stored passwords.
Summary
The legacy password check in Catalyst::Plugin::Authentication for Perl exposes stored passwords to timing attacks. A remote attacker can use response-time differences to guess a stored password or hash, in versions before 0.10029.
Affected when
- Legacy password verifier used through the deprecated login method
- Versions before 0.10029
What to do
Versions before 0.10029 are affected, so check that the installed module is 0.10029 or newer and read the advisory.
Products and platforms
CVE IDs
Sources
- Advisory: metacpan.org (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen