========================================================================
CVE-2024-57854                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2024-57854
   Distribution:  Net-NSCA-Client
       Versions:  through 0.009002

       MetaCPAN:  https://metacpan.org/dist/Net-NSCA-Client
       VCS Repo:  https://github.com/dougwilson/perl5-net-nsca-client

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random
number generator

Description
-----------
Net::NSCA::Client versions through 0.009002 for Perl uses a poor random
number generator.

Version v0.003 switched to use Data::Rand::Obscure instead of
Crypt::Random for generation of a random initialisation vectors.

Data::Rand::Obscure uses Perl's built-in rand() function, which is not
suitable for cryptographic functions.

Problem types
-------------
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
   (PRNG)

Solutions
---------
Apply a manual patch or migrate to a different solution

References
----------
https://metacpan.org/release/DOUGDUDE/Net-NSCA-Client-0.009002/source/lib/Net/NSCA/Client/InitialPacket.pm#L119
https://patch-diff.githubusercontent.com/raw/dougwilson/perl5-net-nsca-client/pull/2.patch

Credits
-------
Robert Rothenberg, finder