CVE-2025-1828

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1828
Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/perl-Crypt-OpenPGP/Crypt-Random/commit/1f8b29e9e89d8d083fd025152e76ec918136cc05
https://github.com/perl-Crypt-OpenPGP/Crypt-Random/pull/1
https://perldoc.perl.org/functions/rand
Configurations

No configuration.

History

26 Mar 2025, 02:15

Type Values Removed Values Added
Summary
  • (es) El paquete Crypt::Random Perl 1.05 a 1.55 puede utilizar la función rand(), que no es criptográficamente segura, para funciones criptográficas. Crypt::Random::rand 1.05 a 1.55 utiliza la función rand(). Si no se especifica el proveedor y /dev/urandom o un servicio Entropy Gathering Daemon (egd) no está disponible, Crypt::Random utilizará de forma predeterminada el proveedor inseguro Crypt::Random::rand. En particular, las versiones de Windows de Perl encontrarán este problema de forma predeterminada.
Summary (en) Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. Crypt::Random::rand 1.05 through 1.55 uses the rand() function. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default. (en) Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default.

11 Mar 2025, 03:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

11 Mar 2025, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-11 00:15

Updated : 2025-03-26 02:15

NVD link : CVE-2025-1828

Mitre link : CVE-2025-1828

CVE.ORG link : CVE-2025-1828

JSON object : View

Products Affected

No product.

CWE
CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)