fkie_cve-2025-2814
Vulnerability from fkie_nvd
Published
2025-04-13 00:15
Modified
2025-09-05 14:15
Severity ?
Summary
Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\n\nThis issue affects operating systems where \"/dev/urandom\u0027\" is unavailable.\u00a0 In that case, Crypt::CBC will fallback to use the insecure rand() function."
},
{
"lang": "es",
"value": "Las versiones de Crypt::CBC entre la 1.21 y la 3.04 para Perl pueden usar la funci\u00f3n rand() como fuente predeterminada de entrop\u00eda, la cual no es criptogr\u00e1ficamente segura, para funciones criptogr\u00e1ficas. Este problema afecta a sistemas operativos donde \"/dev/urandom\u0027\" no est\u00e1 disponible. En ese caso, Crypt::CBC recurrir\u00e1 a la funci\u00f3n rand(), que no es segura."
}
],
"id": "CVE-2025-2814",
"lastModified": "2025-09-05T14:15:44.323",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.5,
"impactScore": 1.4,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-04-13T00:15:14.997",
"references": [
{
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"url": "https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c126ebf535.patch"
},
{
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"url": "https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777"
},
{
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"url": "https://perldoc.perl.org/functions/rand"
},
{
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
}
],
"sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-329"
},
{
"lang": "en",
"value": "CWE-331"
},
{
"lang": "en",
"value": "CWE-338"
}
],
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-338"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…