CVE-2025-1828: Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions
Timothy Legge 11 Mar 2025 00:32 UTC
========================================================================
CVE-2025-1828 CPAN Security Group
========================================================================
CVE ID: CVE-2025-1828
Distribution: Crypt-Random
Versions: from 1.05 until 1.56
MetaCPAN: https://metacpan.org/dist/Crypt-Random
Perl's Crypt::Random module after 1.05 and before 1.56 may use rand()
function for cryptographic functions
Description
-----------
Crypt::Random Perl package 1.05 through 1.55 may use rand() function,
which is not cryptographically strong, for cryptographic functions.
Crypt::Random::rand 1.05 through 1.55 uses the rand() function. If the
Provider is not specified and /dev/urandom or an Entropy Gathering
Daemon (egd) service is not available Crypt::Random will default to use
the insecure Crypt::Random::rand provider.
In particular, Windows versions of perl will encounter this issue by
default.
Problem types
-------------
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
(PRNG)
Mitigations
-----------
Upgrade to version 1.56 or higher
References
----------
https://perldoc.perl.org/functions/rand
https://github.com/perl-Crypt-OpenPGP/Crypt-Random/pull/1
https://github.com/perl-Crypt-OpenPGP/Crypt-Random/commit/1f8b29e9e89d8d083fd025152e76ec918136cc05
Credits
-------
Robert Rothenberg (RRWO), finder