VDB
CVE-2025-2814
CVE-2025-2814
PUBLISHED
CVSS 4 MEDIUM
Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.
EPSS 0.19% · 8.6th percentile
Risk Scores
CVSS 3.1
4
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score
0.19%
8.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| LDS | Crypt::CBC | 1.21 |
Timeline
- Apr 12, 2025 CVE Published
- Apr 13, 2025 EPSS Score
- Apr 13, 2025 PoC Published
- Apr 18, 2025 Coalition ESS Score
- Apr 26, 2025 EPSS Score
- May 8, 2025 EPSS Score
- May 13, 2025 Coalition ESS Score
- May 21, 2025 EPSS Score
- Jun 2, 2025 EPSS Score
- Jun 14, 2025 Coalition ESS Score
- Jun 15, 2025 EPSS Score
- Jun 16, 2025 Coalition ESS Score
References
- https://perldoc.perl.org/functions/rand url
- https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777 url
- https://security.metacpan.org/docs/guides/random-data-for-security.html url
- https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c126ebf535.patch patch
- https://nvd.nist.gov/vuln/detail/CVE-2025-2814 advisory