# CVE-2017-20240: libcrypt-pbkdf2-perl: Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks

CVE-2017-20240 is fixed in 2 products on 1 platform, first by FEDORA-2026-E8231B773D, released June 12, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2017-20240
- Priority: Routine
- CVSS: 5.9 (medium)
- EPSS: 0.0032
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 12, 2026

## Description

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks.  These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libcrypt-pbkdf2-perl Debian 12.15 (bookworm) | 0.261630-1~deb13u1~deb12u1 | [DEBIAN-CVE-2017-20240](https://patchblox.com/security/data/fix/linux/debian-cve-2017-20240.md) | Jun 24, 2026 |
| Linux | libcrypt-pbkdf2-perl Debian 13.5 (trixie) | 0.261630-1~deb13u1 | [DEBIAN-CVE-2017-20240](https://patchblox.com/security/data/fix/linux/debian-cve-2017-20240.md) | Jun 24, 2026 |
| Linux | libcrypt-pbkdf2-perl Debian 14 | 0.261630-1 | [DEBIAN-CVE-2017-20240](https://patchblox.com/security/data/fix/linux/debian-cve-2017-20240.md) | Jun 24, 2026 |
| Linux | perl-Crypt-PBKDF2 Fedora 43 | 0.261630-1.fc43 | [FEDORA-2026-E8231B773D](https://patchblox.com/security/data/fix/linux/fedora-2026-e8231b773d.md) | Jun 12, 2026 |
| Linux | perl-Crypt-PBKDF2 amzn 2023 | 0.261630-1.amzn2023.0.1 | [ALAS2023-2026-1891](https://patchblox.com/security/data/fix/linux/alas2023-2026-1891.md) | Jun 22, 2026 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo