Perl Crypt::Password Generates Predictable Cryptographic Salts

Crypt::Password versions through 0.28 for Perl suffer from a critical cryptographic weakness in salt generation, using the built-in rand() function instead of cryptographically secure random sources. This vulnerability (CWE-338: Use of Insufficiently Random Values) allows attackers to predict password salts, dramatically reducing the computational cost of brute-force and rainbow table attacks against hashed passwords. Any Perl application relying on this library for password storage—particularly in authentication systems, identity management platforms, and legacy applications—faces immediate risk of credential compromise. The 9.8 CVSS score reflects the near-complete loss of password security guarantees that salts are designed to provide.

While this CVE currently has zero mapped MITRE ATT&CK techniques and zero matching Casky skills, practitioners using Casky's extended reasoning capabilities with Claude AI should monitor for attack patterns associated with credential access (T1110: Brute Force, T1040: Network Sniffing of plaintext credentials) and defense evasion tactics that exploit weak cryptography. Security teams should focus detection efforts on identifying systems running vulnerable Crypt::Password versions through dependency analysis and code scanning, then prioritizing password reset campaigns. The lack of current threat intelligence mappings underscores why continuous security education and proactive vulnerability assessment—rather than reactive threat hunting—remains essential for addressing cryptographic weaknesses before active exploitation emerges.