CVE-2025-2814CWE-329CWE-331CWE-338

Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions

Medium · published April 12, 2025

CVSS v3.1
4.0
EPSS
0%
Percentile
9.0
In the wild
Unconfirmed
What it is

Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

This issue affects operating systems where "/dev/urandom'" is unavailable.  In that case, Crypt::CBC will fallback to use the insecure rand() function.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00197 · 9.0th percentile
Weaknesses
CWE-329 · Generation of Predictable IV with CBC Mode; CWE-331 · Insufficient Entropy; CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2025-04-12T23:41Z
EPSS history
Timeline
  • 12 APR 23:41Z
    Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions
    cvelistv5