CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key.

getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed.

An attacker who obtains a backup can recover its password by fast offline guessing, and with it every credential the backup holds.

Üreticinin çözüm notu (İngilizce)

Upgrade to CallBackery 0.62.0 or later.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• metacpan.org/release/OETIKER/CallBackery-0.62.0/changes Diğer

Kayıt geçmişi

1. 6 Kas 2026 20:00CVSS puanı değişti: – → 7.5
2. 30 Eki 2026 16:12Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-118986CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
• 5,3 CVE-2026-118987CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
• 5,5 CVE-2026-118990CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup
• 8,4 CVE-2026-118992CallBackery (Perl) yapılandırma yedeği geri yüklemede işletim sistemi komutu çalıştırma
• 7,5 CVE-2026-118993CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI
• 9,8 CVE-2026-118994CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name