========================================================================
CVE-2024-58036                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2024-58036
   Distribution:  Net-Dropbox-API
       Versions:  through 1.9

       MetaCPAN:  https://metacpan.org/dist/Net-Dropbox-API

Net::Dropbox::API 1.9 and earlier for Perl uses insecure rand()
function for cryptographic functions

Description
-----------
Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as
the default source of entropy, which is not cryptographically secure,
for cryptographic functions.

Specifically Net::Dropbox::API uses the Data::Random library which
specifically states that it is "Useful mostly for test programs".
Data::Random uses the rand() function.

Problem types
-------------
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
(PRNG)

References
----------
https://perldoc.perl.org/functions/rand
https://security.metacpan.org/docs/guides/random-data-for-security.html
https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537
https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L385
https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L11

Credits
-------
Robert Rothenberg (RRWO), finder