Untriaged
Permalink
CVE-2025-2814
4.0 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): NONE
- Availability impact (A): LOW
Crypt::CBC versions between 1.21 and 3.04 for Perl may use insecure rand() function for cryptographic functions
Crypt::CBC versions between 1.21 and 3.04 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.
References
- https://perldoc.perl.org/functions/rand
- https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777
- https://security.metacpan.org/docs/guides/random-data-for-security.html
- https://perldoc.perl.org/functions/rand
- https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777
- https://security.metacpan.org/docs/guides/random-data-for-security.html
- https://perldoc.perl.org/functions/rand
- https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777
- https://security.metacpan.org/docs/guides/random-data-for-security.html
- https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c1… patch
- https://security.metacpan.org/docs/guides/random-data-for-security.html
- https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c1… patch
- https://perldoc.perl.org/functions/rand
- https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777
Affected products
Crypt-CBC
- =<3.04
- =<3.05
Matching in nixpkgs
pkgs.perlPackages.CryptCBC
Encrypt Data with Cipher Block Chaining Mode
-
nixos-unstable -
- nixpkgs-unstable 2.33
pkgs.perl538Packages.CryptCBC
Encrypt Data with Cipher Block Chaining Mode
-
nixos-unstable -
- nixpkgs-unstable 2.33
pkgs.perl540Packages.CryptCBC
Encrypt Data with Cipher Block Chaining Mode
-
nixos-unstable -
- nixpkgs-unstable 2.33