CVE-2026-118991

Full vulnerability record from the local CVENow database.

Description

CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed. An attacker who obtains a backup can recover its password by fast offline guessing, and with it every credential the backup holds.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

9b29abf9-4ab0-4765-b253-1875cd9b441e

Published

2026-10-30 13:18:31.880000

Last modified

2026-10-30 13:18:31.880000

View original CVE JSON

{
  "id": "CVE-2026-118991",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-10-30T13:18:31.880",
  "lastModified": "2026-10-30T13:18:31.880",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key.\n\ngetCrypt() pads the backup password with \"x\" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed.\n\nAn attacker who obtains a backup can recover its password by fast offline guessing, and with it every credential the backup holds."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "CallBackery",
          "modules": [
            "CallBackery"
          ],
          "programFiles": [
            "lib/CallBackery/Config.pm"
          ],
          "programRoutines": [
            {
              "name": "CallBackery::Config::getCrypt"
            },
            {
              "name": "CallBackery::Config::getConfigBlob"
            },
            {
              "name": "CallBackery::Config::restoreConfigBlob"
            }
          ],
          "repo": "https://github.com/oetiker/callbackery",
          "packageURL": "pkg:cpan/CallBackery",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.62.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-916"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}