Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 3 articles for you...
89
security advisoryupdate informationfederalFedora 43 python-bcrypt Security Advisory Update 2026-31ec71cf0b
Update PyO3 to 0.29; addresses RUSTSEC-2026-0176 and RUSTSEC-2026-0177. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-31ec71cf0b 2026-07-16 01:28:35.510742+00:00 -------------------------------------------------------------------------------- Name : python-bcrypt Product : Fedora 43 Version : 4.3.0 Release : 14.fc43 URL : https://pypi.python.org/pypi/bcrypt Summary : Modern password hashing for your software and your servers Description : Modern password hashing for your software and your servers. -------------------------------------------------------------------------------- Update Information: Update PyO3 to 0.29; addresses RUSTSEC-2026-0176 and RUSTSEC-2026-0177 -------------------------------------------------------------------------------- ChangeLog: * Tue Jul 7 2026 Benjamin A. Beasley - 4.3.0-14 - Update PyO3 to 0.29; addresses RUSTSEC-2026-0176 and RUSTSEC-2026-0177 * Tue Jul 7 2026 Benjamin A. Beasley - 4.3.0-13 - Replace BuildRequires: rust-packaging with cargo-rpm-macros * Tue Jul 7 2026 Benjamin A. Beasley - 4.3.0-12 - Drop manual BuildRequires on python3-devel * Tue Jul 7 2026 Benjamin A. Beasley - 4.3.0-10 - Switch URL from HTTP to HTTPS * Wed Jun 3 2026 Python Maint - 4.3.0-8 - Rebuilt for Python 3.15 * Sat Jan 17 2026 Fedora Release Engineering - 4.3.0-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-31ec71cf0b' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 15, 2026
•Important
Fedora
89
security advisoryfedoraimportantFedora 44 python-bcrypt Important RUSTSEC Update 2026-65b6511854
Update PyO3 to 0.29; addresses RUSTSEC-2026-0176 and RUSTSEC-2026-0177. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-65b6511854 2026-07-16 01:19:18.912130+00:00 -------------------------------------------------------------------------------- Name : python-bcrypt Product : Fedora 44 Version : 4.3.0 Release : 14.fc44 URL : https://pypi.python.org/pypi/bcrypt Summary : Modern password hashing for your software and your servers Description : Modern password hashing for your software and your servers. -------------------------------------------------------------------------------- Update Information: Update PyO3 to 0.29; addresses RUSTSEC-2026-0176 and RUSTSEC-2026-0177 -------------------------------------------------------------------------------- ChangeLog: * Tue Jul 7 2026 Benjamin A. Beasley - 4.3.0-14 - Update PyO3 to 0.29; addresses RUSTSEC-2026-0176 and RUSTSEC-2026-0177 * Tue Jul 7 2026 Benjamin A. Beasley - 4.3.0-13 - Replace BuildRequires: rust-packaging with cargo-rpm-macros * Tue Jul 7 2026 Benjamin A. Beasley - 4.3.0-12 - Drop manual BuildRequires on python3-devel * Tue Jul 7 2026 Benjamin A. Beasley - 4.3.0-10 - Switch URL from HTTP to HTTPS * Wed Jun 3 2026 Python Maint - 4.3.0-8 - Rebuilt for Python 3.15 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-65b6511854' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 15, 2026
•Important
Fedora
89
security advisoryfedoraimportantFedora 43 perl-Crypt-PBKDF2 Crucial Hashing Upgrade 2026-e8231b773d
This update addresses a number of security issues: Change the default hash algorithm to HMAC-SHA256, and increase the default number of iterations to 600,000, in line with current OWASP recommendations (CVE-2026-9641) Generate salts using Crypt::URandom (a strong system RNG) instead of perl's. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-e8231b773d 2026-06-21 01:09:26.438190+00:00 -------------------------------------------------------------------------------- Name : perl-Crypt-PBKDF2 Product : Fedora 43 Version : 0.261630 Release : 1.fc43 URL : https://metacpan.org/release/Crypt-PBKDF2 Summary : The PBKDF2 password hashing algorithm Description : PBKDF2 is a secure password hashing algorithm that uses the techniques of "key strengthening" to make the complexity of a brute-force attack arbitrarily high. PBKDF2 uses any other cryptographic hash or cipher (by convention, usually HMAC-SHA2, but Crypt::PBKDF2 is fully pluggable), and allows for an arbitrary number of iterations of the hashing function, and a nearly unlimited output hash size (up to 2**32-1 times the size of the output of the backend hash). The hash is salted, as any password hash should be, and the salt may also be of arbitrary size. -------------------------------------------------------------------------------- Update Information: This update addresses a number of security issues: Change the default hash algorithm to HMAC-SHA256, and increase the default number of iterations to 600,000, in line with current OWASP recommendations (CVE-2026-9641) Generate salts using Crypt::URandom (a strong system RNG) instead of perl's builtin rand(), which is not cryptographically secure (CVE-2026-9638) Use a constant-time comparison in validate to avoid timing attacks (CVE-2017-20240) -------------------------------------------------------------------------------- ChangeLog: * Fri Jun 12 2026 Paul Howarth -0.261630-1 - Update to 0.261630 (rhbz#2488228) - Change the default hash algorithm to HMAC-SHA256, and increase the default number of iterations to 600,000, in line with current OWASP recommendations (CVE-2026-9641) - Generate salts using Crypt::URandom (a strong system RNG) instead of perl's builtin rand(), which is not cryptographically secure (CVE-2026-9638) - Use a constant-time comparison in 'validate' to avoid timing attacks (CVE-2017-20240) - Switch to Module::Build::Tiny flow - Package new README file * Sat Jan 17 2026 Fedora Release Engineering - 0.161520-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2488228 - perl-Crypt-PBKDF2-0.261630 is available https://bugzilla.redhat.com/show_bug.cgi?id=2488228 [ 2 ] Bug #2488894 - CVE-2017-20240 perl-Crypt-PBKDF2: information disclosure via timing attack [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2488894 [ 3 ] Bug #2488896 - CVE-2026-9641 perl-Crypt-PBKDF2: weak default algorithm and insufficient iterations [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2488896 [ 4 ] Bug #2488899 - CVE-2026-9638 perl-Crypt-PBKDF2: generation of insecure random values for salts [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2488899 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-e8231b773d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 20, 2026
•Important
Fedora
89
security advisoryfedoraimportantFedora 44 Perl-Crypt-PBKDF2 Important Timing Attack Fix 2026-5b12cc327e
This update addresses a number of security issues: Change the default hash algorithm to HMAC-SHA256, and increase the default number of iterations to 600,000, in line with current OWASP recommendations (CVE-2026-9641) Generate salts using Crypt::URandom (a strong system RNG) instead of perl's. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-5b12cc327e 2026-06-21 00:58:50.478340+00:00 -------------------------------------------------------------------------------- Name : perl-Crypt-PBKDF2 Product : Fedora 44 Version : 0.261630 Release : 1.fc44 URL : https://metacpan.org/release/Crypt-PBKDF2 Summary : The PBKDF2 password hashing algorithm Description : PBKDF2 is a secure password hashing algorithm that uses the techniques of "key strengthening" to make the complexity of a brute-force attack arbitrarily high. PBKDF2 uses any other cryptographic hash or cipher (by convention, usually HMAC-SHA2, but Crypt::PBKDF2 is fully pluggable), and allows for an arbitrary number of iterations of the hashing function, and a nearly unlimited output hash size (up to 2**32-1 times the size of the output of the backend hash). The hash is salted, as any password hash should be, and the salt may also be of arbitrary size. -------------------------------------------------------------------------------- Update Information: This update addresses a number of security issues: Change the default hash algorithm to HMAC-SHA256, and increase the default number of iterations to 600,000, in line with current OWASP recommendations (CVE-2026-9641) Generate salts using Crypt::URandom (a strong system RNG) instead of perl's builtin rand(), which is not cryptographically secure (CVE-2026-9638) Use a constant-time comparison in validate to avoid timing attacks (CVE-2017-20240) -------------------------------------------------------------------------------- ChangeLog: * Fri Jun 12 2026 Paul Howarth -0.261630-1 - Update to 0.261630 (rhbz#2488228) - Change the default hash algorithm to HMAC-SHA256, and increase the default number of iterations to 600,000, in line with current OWASP recommendations (CVE-2026-9641) - Generate salts using Crypt::URandom (a strong system RNG) instead of perl's builtin rand(), which is not cryptographically secure (CVE-2026-9638) - Use a constant-time comparison in 'validate' to avoid timing attacks (CVE-2017-20240) - Switch to Module::Build::Tiny flow - Package new README file -------------------------------------------------------------------------------- References: [ 1 ] Bug #2488228 - perl-Crypt-PBKDF2-0.261630 is available https://bugzilla.redhat.com/show_bug.cgi?id=2488228 [ 2 ] Bug #2488894 - CVE-2017-20240 perl-Crypt-PBKDF2: information disclosure via timing attack [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2488894 [ 3 ] Bug #2488896 - CVE-2026-9641 perl-Crypt-PBKDF2: weak default algorithm and insufficient iterations [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2488896 [ 4 ] Bug #2488899 - CVE-2026-9638 perl-Crypt-PBKDF2: generation of insecure random values for salts [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2488899 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-5b12cc327e' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list
Jun 20, 2026
•Important
Fedora
203
security advisoryimportantpassword hashingMageia 9 perl-DBIx-Class-EncodedColumn Notable Password Salting Issues
Security update. Publication date: 06 Jun 2026 URL: https://advisories.mageia.org/MGASA-2026-0176.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-27551, CVE-2025-27552 Description: The updated perl-DBIx-Class-EncodedColumn and new perl-Crypt-URandom-Token packages fix security issues: DBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Digest.pm (CVE-2025-27551) DBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pm (CVE-2025-27552) References: - https://bugs.mageia.org/show_bug.cgi?id=34215 - https://lists.fedoraproject.org/archives/list/
Jun 06, 2026
•Important
Mageia
203
security advisorybuffer overflowphpMageia 8: 2023-0065 Critical: Invalid Hash Handling and DoS Risk
The password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid. (CVE-2023-0567) The core path resolution function allocates a buffer one byte too small. . MGASA-2023-0065 - Updated php packages fix security vulnerability Publication date: 27 Feb 2023 URL: https://advisories.mageia.org/MGASA-2023-0065.html Type: security Affected Mageia releases: 8 CVE: CVE-2023-0567, CVE-2023-0568, CVE-2023-0662 The password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid. (CVE-2023-0567) The core path resolution function allocates a buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification. (CVE-2023-0568) Excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space. (CVE-2023-0662) References: - https://bugs.mageia.org/show_bug.cgi?id=31549 - https://www.php.net/ChangeLog-8.php#8.0.28 - https://www.cve.org/CVERecord?id=CVE-2023-0567 - https://www.cve.org/CVERecord?id=CVE-2023-0568 - https://www.cve.org/CVERecord?id=CVE-2023-0662 SRPMS: - 8/core/php-8.0.28-1.mga8 . Mageia 8's latest PHP update resolves critical vulnerabilities including improper password hash verification and potential denial of service threats.. Security Update, PHP Issues, Mageia 8 Advisory. . Severity: Critical. LinuxSecurity.com Team
Feb 27, 2023
•Critical
Mageia
202
security advisorysoftware patchimportant updateopenSUSE Leap 15.3 Important: Cryptctl Password Client Issue
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for cryptctl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2136-1 Rating: important References: #1186226 Cross-References: CVE-2019-18906 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cryptctl fixes the following issues: Update to version 2.4: - CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226) - First step to use plain text password instead of hashed password. - Move repository into the SUSE github organization - in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address - tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case - avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2136=1 Package List: - openSUSE Leap 15.3 (ppc64le x86_64): cryptctl-2.4-4.5.1 cryptctl-debuginfo-2.4-4.5.1 References: https://www.suse.com/security/cve/CVE-2019-18906.html https://bugzilla.suse.com/1186226 . Critical patch released for cryptctl taking care of a severe client password encryption flaw in openSUSE Leap 15.3.. openSUSE Security Update,Crypto Security,Password Management. . Severity: Important.LinuxSecurity.com Team
Jul 10, 2021
•Important
OpenSUSE
200
security advisorymoderate severitypassword hashingScientific Linux: CVE-2011-2483 Moderate PostgreSQL Password Strength Issue
Moderate: postgresql security update. Date: Tue, 18 Oct 2011 15:30:49 -0500 Reply-To:
Oct 18, 2011
Scientific Linux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!