CVE-2025-2814
Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions
Summary
Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions
Original description
The description as published by the source.
Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-2814 libcrypt-cbc-perl
- Ubuntu UBUNTU-CVE-2025-2814 libcrypt-cbc-perl
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- web cpan.org
- web metacpan.org
- web perldoc.perl.org
- web security.metacpan.org