Random Number Generation Issue in Net::EasyTCP for Perl by MNAGUIB

CVE-2024-56830

Summary

The Net::EasyTCP package for Perl, specifically versions 0.15 through 0.26, incorporates a security issue related to the use of Perl's built-in rand() function for random number generation in the absence of a strong randomization module. This reliance on weak randomization can result in predictable outputs, thereby exposing applications that utilize this package to a range of potential security threats, including reliance on compromised or predictable session tokens.

References