CVE-2018-25107

CVE-2018-25107

Vendor N/A

Product n/a

Weakness CWE-338

Published December 29, 2024

Last update December 31, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of random bits.

Key dates

02Disclosure timeline

December 29, 2024 CVE published

December 31, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-25107 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/338.html

Related vulnerabilities

04Related CVE

CVE-2025-54883 Vision UI's security-kit Contains Cryptographic Weakness CVE-2024-56830 CVE-2025-2814 Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions CVE-2026-9638 Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts CVE-2025-59390 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.