CVE-2025-2814: Crypt::CBC versions between 1.21 and 3.04 for Perl may use insecure rand() function for cryptographic functions

4.0 CVSS

Description

Crypt::CBC versions between 1.21 and 3.04 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

This issue affects operating systems where "/dev/urandom'" is unavailable.  In that case, Crypt::CBC will fallback to use the insecure rand() function.

Classification

CVE ID: CVE-2025-2814

CVSS Base Severity: MEDIUM

CVSS Base Score: 4.0

Problem Types

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Affected Products

Vendor: LDS

Product: Crypt::CBC

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.02% (probability of being exploited)

EPSS Percentile: 2.19% (scored less or equal to compared to others)

EPSS Date: 2025-04-18 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: none

SSVC Technical Impact: partial

SSVC Automatable: false

References

https://nvd.nist.gov/vuln/detail/CVE-2025-2814
https://perldoc.perl.org/functions/rand
https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777
https://security.metacpan.org/docs/guides/random-data-for-security.html

Timeline