Cryptographic Weakness in Perl Crypt::Random Package by Perl

CVE-2025-1828

Summary

The Crypt::Random Perl package versions 1.05 to 1.55 may utilize the rand() function, which lacks cryptographic strength for secure operations. In the absence of a specified Provider, and where /dev/urandom or an Entropy Gathering Daemon (EGD) service is unavailable, the package defaults to an insecure random number generation method. This vulnerability is particularly relevant for users on Windows systems running Perl, where the insecure option may be employed by default. It is critical to ensure that secure randomness sources are utilized to prevent potential exploitation.

References