CVE-2024-57835CWE-338

Amon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functions

Medium · published April 5, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values.

String::Random defaults to Perl's built-in predictable random number generator, the rand() function, which is not cryptographically secure

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00287 · 20.1th percentile
Weakness
CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2025-04-05T16:11Z
EPSS history
Timeline
  • 05 APR 16:11Z
    Amon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functions
    cvelistv5