CVE-2017-20240
libcrypt-pbkdf2-perl: Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks
CVE-2017-20240 is fixed in 2 products on 1 platform, first by FEDORA-2026-E8231B773D, released June 12, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
5.9
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0032
24th percentile
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libcrypt-pbkdf2-perl · Debian 12.15 (bookworm) | 0.261630-1~deb13u1~deb12u1 | DEBIAN-CVE-2017-20240 | Jun 24, 2026 |
| libcrypt-pbkdf2-perl · Debian 13.5 (trixie) | 0.261630-1~deb13u1 | DEBIAN-CVE-2017-20240 | Jun 24, 2026 |
| libcrypt-pbkdf2-perl · Debian 14 | 0.261630-1 | DEBIAN-CVE-2017-20240 | Jun 24, 2026 |
| perl-Crypt-PBKDF2 · Fedora 43 | 0.261630-1.fc43 | FEDORA-2026-E8231B773D | Jun 12, 2026 |
| perl-Crypt-PBKDF2 · amzn 2023 | 0.261630-1.amzn2023.0.1 | ALAS2023-2026-1891 | Jun 22, 2026 |