VulnerabilityDeferred
CVE-2025-2814
In that case, Crypt::CBC will fallback to use the insecure rand() function.
MEDIUM 4.0EPSS 0.20%
Does this matter?
Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.
Description
Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.
- CVSS 3.1
- 4.0 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 0.20% probability · 9th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-329, CWE-331, CWE-338
- Source
- 9b29abf9-4ab0-4765-b253-1875cd9b441e
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.