CVE-2025-1860

Summary

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Affected Software

Weaknesses

• CWE-338: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
• CWE-331: CWE-331 Insufficient Entropy

ADP Enrichment

CVE Program Container

Additional References

• https://lists.debian.org/debian-lts-announce/2025/03/msg00026.html

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://perldoc.perl.org/functions/rand
• https://metacpan.org/release/ZEFRAM/Data-Entropy-0.007/source/lib/Data/Entropy.pm#L80

• ←Previous
• Next→