CVE-2025-1860CWE-331CWE-338

Data::Entropy for Perl uses insecure rand() function for cryptographic functions

High · published March 28, 2025

CVSS v3.1
7.7
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00191 · 8.3th percentile
Weaknesses
CWE-331 · Insufficient Entropy; CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2025-03-28T00:56Z
EPSS history
Timeline
  • 28 MAR 00:56Z
    Data::Entropy for Perl uses insecure rand() function for cryptographic functions
    cvelistv5