Insecure Random Number Generation in Perl Crypt::Random::Source Package

CVE-2018-25107

Summary

The Crypt::Random::Source package for Perl, prior to version 0.13, exhibits a vulnerability due to its reliance on the built-in rand() function, which is not a secure method for generating random bits. This fallback mechanism compromises the randomness quality essential for cryptographic operations and could potentially allow for predictable and repeatable results, thus jeopardizing the security of applications relying on robust random number generation. Developers utilizing this package are urged to upgrade to the latest version to mitigate risks associated with insecure random number generation.

References