CVE-2025-27552CWE-331CWE-338CWE-916

DBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pm

Medium · published March 26, 2025

CVSS v3.1
4.0
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.

This vulnerability is associated with program files Crypt/Eksblowfish/Bcrypt.pm.

This issue affects DBIx::Class::EncodedColumn until 0.00032.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00118 · 1.6th percentile
Weaknesses
CWE-331 · Insufficient Entropy; CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG); CWE-916 · Use of Password Hash With Insufficient Computational Effort
Published
2025-03-26T11:08Z
EPSS history
Timeline
  • 26 MAR 11:08Z
    DBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pm
    cvelistv5