The RSAVAGE Crypt::PasswdMD5 Perl module versions up to 1.42 generate salts for password hashing using the built-in rand function, which is a cryptographically weak PRNG. This weakness (CWE-338) results in predictable salt values, reducing the effectiveness of the password hashing process. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting high severity due to network attack vector, low attack complexity, no privileges required, and high confidentiality impact. No official patch or remediation level has been provided as of the publication date.

The use of a predictable PRNG for salt generation can allow attackers to anticipate or reproduce salt values, potentially facilitating offline password cracking attacks. This compromises the confidentiality of hashed passwords but does not affect integrity or availability. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider alternative modules or methods that use cryptographically secure random number generators for salt generation. Avoid relying on Crypt::PasswdMD5 for new deployments where strong password hashing is required.