CVE-2025-1860

EUVD-2025-8533
Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.37%
Debian logo
Debian Releases
Debian Product
Codename
libdata-entropy-perl
bookworm
0.007-4+deb12u1
fixed
forky
0.008-1
fixed
sid
0.008-1
fixed
trixie
0.008-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libdata-entropy-perl
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
ignored
questing
ignored
resolute
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://metacpan.org/release/ZEFRAM/Data-Entropy-0.007/source/lib/Data/Entropy.pm#L80
https://perldoc.perl.org/functions/rand
https://lists.debian.org/debian-lts-announce/2025/03/msg00026.html