The Crypt::Password Perl module contains a critical flaw in its random value generation that allows for the compromise of cryptographic salts.

The software uses the standard Perl rand function to generate cryptographic salts, which is not designed for security-sensitive operations. This vulnerability is exploitable by an unauthenticated attacker, as the predictable nature of the output can lead to the compromise of password hashes.

This vulnerability carries a CVSS score of 9.8, indicating a critical severity due to the potential for total system compromise. If salts are predictable, attackers can perform offline brute-force attacks against password databases, leading to widespread credential theft and unauthorized access to sensitive user data.

Immediate Action: Upgrade to the latest version of Crypt::Password when a secure version becomes available. Developers should audit existing password stores to determine if re-hashing is required due to potentially compromised salts.

Proactive Monitoring: Monitor authentication logs for an unusual spike in failed login attempts, which may indicate offline cracking efforts.

Compensating Controls: Implement additional layers of defense such as multi-factor authentication to reduce reliance on password security alone while the patching process is underway.

Public Exploit Available: unknown

The reliance on a non-cryptographic PRNG for security functions is a severe design flaw that necessitates immediate remediation. Organizations using this library should prioritize updating their environment and evaluating the integrity of existing password hashes as soon as a patch is released by the vendor.