========================================================================
CVE-2025-1828                                        CPAN Security Group
========================================================================

         CVE ID:  CVE-2025-1828
   Distribution:  Crypt-Random
       Versions:  from 1.05 until 1.56

       MetaCPAN:  https://metacpan.org/dist/Crypt-Random

Perl's Crypt::Random module after 1.05 and before 1.56 may use rand()
function for cryptographic functions

Description
-----------
Crypt::Random Perl package 1.05 through 1.55 may use rand() function,
which is not cryptographically strong, for cryptographic functions.

Crypt::Random::rand 1.05 through 1.55 uses the rand() function.  If the
Provider is not specified and /dev/urandom or an Entropy Gathering
Daemon (egd) service is not available Crypt::Random will default to use
the insecure Crypt::Random::rand provider.

In particular, Windows versions of perl will encounter this issue by
default.

Problem types
-------------
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
(PRNG)

Mitigations
-----------
Upgrade to version 1.56 or higher

References
----------
https://perldoc.perl.org/functions/rand
https://github.com/perl-Crypt-OpenPGP/Crypt-Random/pull/1
https://github.com/perl-Crypt-OpenPGP/Crypt-Random/commit/1f8b29e9e89d8d083fd025152e76ec918136cc05

Credits
-------
Robert Rothenberg (RRWO), finder