Fedora 43 and 44 Perl-Crypt-PBKDF2 Security Updates Address Critical Vulnerabilities

Fedora has released updates for the perl-Crypt-PBKDF2 package to address several security vulnerabilities. The updates include changing the default hash algorithm to HMAC-SHA256 and increasing the number of iterations to 600,000, aligning with OWASP recommendations (CVE-2026-9641). Additionally, salts will now be generated using Crypt::URandom instead of perl's insecure rand() function (CVE-2026-9638). A constant-time comparison method is implemented in the validation process to mitigate timing attacks (CVE-2017-20240). These vulnerabilities affect all users of the perl-Crypt-PBKDF2 package in Fedora distributions. The updates were published on June 12, 2026, and users are encouraged to apply them using the dnf update program. The updates are crucial for enhancing the security posture of applications relying on this package.

Key Points: • Fedora updates perl-Crypt-PBKDF2 to address multiple security vulnerabilities. • Default hash algorithm changed to HMAC-SHA256 with increased iterations to 600,000. • Salts will now be generated using a cryptographically secure method.