CVE-2025-2814
Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions
Résumé
Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-2814 libcrypt-cbc-perl
- Ubuntu UBUNTU-CVE-2025-2814 libcrypt-cbc-perl
Références
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- web cpan.org
- web metacpan.org
- web perldoc.perl.org
- web security.metacpan.org