CVE-2025-1860

EUVD-2025-8533
Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA-ADPADP
7.7 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Debian logo
Debian Releases
Debian Product
Codename
libdata-entropy-perl
bookworm
0.007-4+deb12u1
fixed
bullseye
vulnerable
bullseye (security)
0.007-3.1+deb11u1
fixed
forky
0.008-1
fixed
sid
0.008-1
fixed
trixie
0.008-1
fixed
Common Weakness Enumeration
References
https://metacpan.org/release/ZEFRAM/Data-Entropy-0.007/source/lib/Data/Entropy.pm#L80
https://perldoc.perl.org/functions/rand
https://lists.debian.org/debian-lts-announce/2025/03/msg00026.html