Threats tagged 'ghsa-p4f5-m8h6-x7p5'

Catalyst::Plugin::Authentication versions before 0.10029 for Perl contain a timing attack vulnerability in the legacy password verifier. The legacy verifier uses eq comparisons for clear-text passwords, crypt hashes, and base64 digests, causing comparison time to vary based on matching leading bytes. This allows a remote attacker to infer stored passwords or hashes by measuring response times. The issue was fixed in the realm-based verifier but remains in the deprecated legacy verifier.