Back Linuxsecurity

Fedora 43 perl-Crypt-PBKDF2 Crucial Hashing Upgrade 2026

Linuxsecurity •LinuxSecurity Advisories • June 21, 2026

This update addresses a number of security issues: Change the default hash algorithm to HMAC-SHA256, and increase the default number of iterations to 600,000, in line with current OWASP recommendations (CVE-2026-9641) Generate salts using Crypt::URandom (a strong system RNG) instead of perl's builtin rand(), which is not cryptographically secure (CVE-2026-9638) Use a constant-time comparison in validate to avoid timing attacks (CVE-2017-20240)

* Fri Jun 12 2026 Paul Howarth - 0.261630-1 - Update to 0.261630 (rhbz#2488228) - Change the default hash algorithm to HMAC-SHA256, and increase the default number of iterations to 600,000, in line with current OWASP recommendations (CVE-2026-9641) - Generate salts using Crypt::URandom (a strong system RNG) instead of perl's builtin rand(), which is not cryptographically secure (CVE-2026-9638) - Use a constant-time comparison in 'validate' to avoid timing attacks (CVE-2017-20240) - Switch to Module::Build::Tiny flow - Package new README file * Sat Jan 17 2026 Fedora Release Engineering - 0.161520-25 - Rebuilt for

[ 1 ] Bug #2488228 - perl-Crypt-PBKDF2-0.261630 is available [ 2 ] Bug #2488894 - CVE-2017-20240 perl-Crypt-PBKDF2: information disclosure via timing attack [fedora-all] [ 3 ] Bug #2488896 - CVE-2026-9641 perl-Crypt-PBKDF2: weak default algorithm and insufficient iterations [fedora-all] [ 4 ] Bug #2488899 - CVE-2026-9638 perl-Crypt-PBKDF2: generation of insecure random values for salts [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-e8231b773d' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 43 and 44 Perl-Crypt-PBKDF2 Security Updates Address Critical Vulnerabilities Fedora has released updates for the perl-Crypt-PBKDF2 package to address several security vulnerabilities. The updates include changing the default hash algorithm to HMAC-SHA256 and increasing the number of iterations to 600,000, aligning with OWASP recommendations (CVE-2026-9641). Additionally, salts will now be generated using Crypt::URandom instead of perl's insecure rand() function (CVE-2026-9638). A constant-time comparison method is implemented in the validation process to mitigate timing attacks (CVE-2017-20240). These vulnerabilities affect all users of the perl-Crypt-PBKDF2 package in Fedora distributions. The updates were published on June 12, 2026, and users are encouraged to apply them using the dnf update program. The updates are crucial for enhancing the security posture of applications relying on this package. 2 sources 58

Extracted Entities

CVEs (3)

CVE-2017-20240 CVE-2026-9638 CVE-2026-9641

CWE Weaknesses (1)

CWE-200 - Exposure of Sensitive Information