Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2017-20240— Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks

AI Predicted 5.3 Difficulty: Moderate EPSS 0.32% · P24

Possible ATT&CK Techniques 1AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 1

VendorProductVersion RangeStatus
ARODLANDCrypt::PBKDF2< 0.261630affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2017-20240

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks
Source: NVD (National Vulnerability Database)
Vulnerability Description
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过时间差异性导致的信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
ARODLAND Crypt::PBKDF2 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ARODLAND Crypt::PBKDF2是ARODLAND的一个Perl编程语言密码学模块。 ARODLAND Crypt::PBKDF2 0.261630之前版本存在信息泄露漏洞，该漏洞源于使用Perl内置的eq比较，时间差异可能被用来猜测派生的密钥。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
ARODLANDCrypt::PBKDF2 0 ~ 0.261630 -

II. Public POCs for CVE-2017-20240

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2017-20240

请登录查看更多情报信息。

Patches & Fixes for CVE-2017-20240 (1)

Other References for CVE-2017-20240 (1)

Same Patch Batch · ARODLAND · 2026-06-12 · 3 CVEs total

CVE-2026-9641Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number o
CVE-2026-9638Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts

IV. Related Vulnerabilities

Same product: Crypt::PBKDF2
Same vendor: ARODLAND
Same weakness: CWE-208

V. Comments for CVE-2017-20240

No comments yet

Leave a comment