UBUNTU-CVE-2026-74846: Medium severity ubuntu/libcatalyst-plugin-authentication-perl vulnerability
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match. A remote attacker can use response-time differences to guess the stored password or hash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Catalyst::Plugin::Authenticationto a version that resolves this vulnerability.Fixed in 0.10029
Event History
Frequently Asked Questions
Which deployments are exposed to this timing attack?
Deployments using Catalyst::Plugin::Authentication before 0.10029 are exposed if they use the legacy password verifier through the deprecated login method. The realm-based verifier is not affected by this issue.
What does an attacker need to exploit it?
An attacker needs remote access to authentication attempts and must be able to measure response-time differences. Those differences can reveal how many leading bytes of a supplied value match the stored clear-text password, crypt hash, or base64 digest.
What can be done if upgrading is not immediately possible?
Move away from the deprecated login method and use the realm-based verifier, which fixed the related timing-comparison issue. This reduces exposure from the legacy verifier's use of eq comparisons.