Read the docs
TI-2006-00875 Aliases CVE-2006-0898GHSA-qpjg-v8f6-cw7j

Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an…

Priority LOW 16Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.

Why it matters now

EPSS 0.0143 73rd percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:lincoln_d._stein:crypt_cbc:*:*:*:*:*:*:*:*up to 2.16VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.00:*:*:*:*:*:*:*1.00VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.10:*:*:*:*:*:*:*1.10VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.20:*:*:*:*:*:*:*1.20VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.21:*:*:*:*:*:*:*1.21VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.22:*:*:*:*:*:*:*1.22VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.24:*:*:*:*:*:*:*1.24VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.25:*:*:*:*:*:*:*1.25VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.00:*:*:*:*:*:*:*2.00VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.01:*:*:*:*:*:*:*2.01VulnerableLincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:*:*:*:*:*:*:*:* Versions up to 2.16 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.00:*:*:*:*:*:*:* Versions 1.00 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.20:*:*:*:*:*:*:* Versions 1.20 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.21:*:*:*:*:*:*:* Versions 1.21 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.22:*:*:*:*:*:*:* Versions 1.22 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.24:*:*:*:*:*:*:* Versions 1.24 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:1.25:*:*:*:*:*:*:* Versions 1.25 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.00:*:*:*:*:*:*:* Versions 2.00 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.01:*:*:*:*:*:*:* Versions 2.01 Vulnerable ·Lincoln D. Stein
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.02:*:*:*:*:*:*:*2.02VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.03:*:*:*:*:*:*:*2.03VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.04:*:*:*:*:*:*:*2.04VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.05:*:*:*:*:*:*:*2.05VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.07:*:*:*:*:*:*:*2.07VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.08:*:*:*:*:*:*:*2.08VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.09:*:*:*:*:*:*:*2.09VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.10:*:*:*:*:*:*:*2.10VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.11:*:*:*:*:*:*:*2.11VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.12:*:*:*:*:*:*:*2.12VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.13:*:*:*:*:*:*:*2.13VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.14:*:*:*:*:*:*:*2.14VulnerableLincoln D. Stein
cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.15:*:*:*:*:*:*:*2.15VulnerableLincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.02:*:*:*:*:*:*:* Versions 2.02 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.03:*:*:*:*:*:*:* Versions 2.03 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.04:*:*:*:*:*:*:* Versions 2.04 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.05:*:*:*:*:*:*:* Versions 2.05 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.07:*:*:*:*:*:*:* Versions 2.07 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.08:*:*:*:*:*:*:* Versions 2.08 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.09:*:*:*:*:*:*:* Versions 2.09 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.10:*:*:*:*:*:*:* Versions 2.10 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.11:*:*:*:*:*:*:* Versions 2.11 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.12:*:*:*:*:*:*:* Versions 2.12 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.13:*:*:*:*:*:*:* Versions 2.13 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.14:*:*:*:*:*:*:* Versions 2.14 Vulnerable ·Lincoln D. Stein
  • cpe:2.3:a:lincoln_d._stein:crypt_cbc:2.15:*:*:*:*:*:*:* Versions 2.15 Vulnerable ·Lincoln D. Stein

Remediation

Red Hat 3 advisories

  • RHSA-2008:0630 Released 2008-08-13 · Red Hat rating Low
    Red Hat Network Satellite Server security update
    • Red Hat Satellite 5.1 (RHEL v.4 AS) jfreechart-0.9.20-3.rhn, mod_perl-2.0.2-12.el4, mod_perl-2.0.2-12.el4.i386 +3
  • RHSA-2008:0524 Released 2008-06-30 · Red Hat rating Low
    Red Hat Network Satellite Server security update
    • Red Hat Satellite v 4.2 (RHEL v.3 AS) jabberd-2.0s10-3.37.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el3.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el3.i386 +8
    • Red Hat Satellite v 4.2 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
  • RHSA-2008:0261 Released 2008-05-20 · Red Hat rating Moderate
    Red Hat Network Satellite Server security update
    • Red Hat Satellite 5.0 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 5.0 (RHEL v.4 AS)Fixed RHSA-2008:0261
Red Hat Satellite 5.1 (RHEL v.4 AS)Fixed RHSA-2008:0630
Red Hat Satellite v 4.2 (RHEL v.3 AS)Fixed RHSA-2008:0524
Red Hat Satellite v 4.2 (RHEL v.4 AS)Fixed RHSA-2008:0524

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-0898
  2. 2026-10-03 Alias added: GHSA-qpjg-v8f6-cw7j

References

Advisory 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences