Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, if Crypt::SecretBuffer was used to store and compare plaintext passwords, then discrepencies in timing could be used to guess the secret password.
| Vendor | Product | Versions |
|---|---|---|
| nerdvana | crypt::secretbuffer | 0 |
Updated severity to MEDIUM, added CVSS estimate 5.3, confirmed CWE-208, exploit availability, active exploitation, patch availability, and added tag 'timing attack'.
Initial creation
