SUSE alert openSUSE-SU-2026:0230-1 (perl-Crypt-SaltedHash)

From:
             
 
maintenance@opensuse.org
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:0230-1: critical: Security update for perl-Crypt-SaltedHash
Date:
             
 
Tue, 07 Jul 2026 03:04:46 +0200
Message-ID:
             
 
<20260707010446.DA814FCD7@maintenance.suse.de>
Archive-link:
             
 
Article

   openSUSE Security Update: Security update for perl-Crypt-SaltedHash
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2026:0230-1
Rating:             critical
References:         #1265912 #1265927 
Cross-References:   CVE-2026-47372 CVE-2026-47373
Affected Products:
                    openSUSE Backports SLE-15-SP7
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   This update for perl-Crypt-SaltedHash fixes the following issues:

   - updated to 0.120.0 (0.12) see
     /usr/share/doc/packages/perl-Crypt-SaltedHash/Changes 0.12
     2026-05-23 07:29:34+01:00 Europe/London
         - Add reference to Crypt::Passphrase::SaltedHash
         - Removed DOS line-endings

   - updated to 0.110.0 (0.11) 0.11      2026-05-20 14:05:07+01:00
     Europe/London
       - Fixed metadata
       - Moved author tests into xt 0.10      2026-05-19
       - Maintenance taken over by Robert Rothenberg <perl@rhizomnic.com>
       - Updated the Git Repository
       - Updated copyright year
       - Minimum Perl version is v5.6.0
       - Added missing prerequisites, fixes RT#116392
       - Security: Use system randomness source to generate the salt
         CVE-2026-47372 boo#1265927
       - Security: Use constant-time comparison of hashes CVE-2026-47373
         boo#1265912
       - Deprecated module
       - Updated README


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP7:

      zypper in -t patch openSUSE-2026-230=1



Package List:

   - openSUSE Backports SLE-15-SP7 (noarch):

      perl-Crypt-SaltedHash-0.120.0-bp157.2.3.1


References:

   https://www.suse.com/security/cve/CVE-2026-47372.html
   https://www.suse.com/security/cve/CVE-2026-47373.html
   https://bugzilla.suse.com/1265912
   https://bugzilla.suse.com/1265927