If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider.
In particular, Windows versions of perl will encounter this issue by default.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| perl | Crypt::Random | unaffected |
|
No data.
No data available yet.
Vendor Solution
Upgrade to version 1.56 or higher
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-7415 | Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default. |
Fri, 05 Sep 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-331 |
Fri, 27 Jun 2025 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Timlegge
Timlegge crypt\ |
|
| CPEs | cpe:2.3:a:timlegge:crypt\:\:random:*:*:*:*:*:perl:*:* | |
| Vendors & Products |
Timlegge
Timlegge crypt\ |
Wed, 26 Mar 2025 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. Crypt::Random::rand 1.05 through 1.55 uses the rand() function. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default. | Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default. |
Tue, 11 Mar 2025 03:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Tue, 11 Mar 2025 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. Crypt::Random::rand 1.05 through 1.55 uses the rand() function. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default. | |
| Title | Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions | |
| Weaknesses | CWE-338 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2025-09-09T13:56:40.704Z
Reserved: 2025-03-01T15:39:14.682Z
Link: CVE-2025-1828
Vulnrichment
Updated: 2025-03-11T02:20:38.444Z
NVD
Status : Analyzed
Published: 2025-03-11T00:15:11.060
Modified: 2025-09-29T22:40:03.673
Link: CVE-2025-1828
Redhat
No data.
OpenCVE Enrichment
No data.