Bug 2374454 - CVE-2025-6547 perl-PBKDF2-Tiny: pbkdf2 silently returns static keys [fedora-42]
Summary: CVE-2025-6547 perl-PBKDF2-Tiny: pbkdf2 silently returns static keys [fedora-42]
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Fedora
Classification: Fedora
Component: perl-PBKDF2-Tiny
Version: 42
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Petr Pisar
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["0b41372b-ed75-407b-a7d0-7...
Depends On:
Blocks: CVE-2025-6547
TreeView+ depends on / blocked
 
Reported: 2025-06-23 23:16 UTC by Jon Moroney
Modified: 2025-06-24 07:39 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-06-24 07:39:07 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Jon Moroney 2025-06-23 23:16:48 UTC
More information about this security flaw is available in the following bug:

https://bugzilla.redhat.com/show_bug.cgi?id=2374378

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Petr Pisar 2025-06-24 07:39:07 UTC
perl-PBKDF2-Tiny-0.005-30.fc42.noarch is not affected:

# perl -MPBKDF2::Tiny=derive -e 'print derive(q{SHA-1}, q{password}, q{salt})' | hexdump -C
00000000  6e 88 be 8b ad 7e ae 9d  9e 10 aa 06 12 24 03 4f  |n....~.......$.O|
00000010  ed 48 d0 3f                                       |.H.?|
00000014
# perl -MPBKDF2::Tiny=derive -e 'print derive(q{SHA-1})' | hexdump -C
00000000  6e 40 91 0a c0 2e c8 9c  eb b9 d8 98 b1 3a 09 d1  |n@...........:..|
00000010  cd 7a df 6f                                       |.z.o|
00000014


Note You need to log in before you can comment on or make changes to this bug.