7.3

CVE-2025-40905

WWW::OAuth 1.000 and earlier for Perl uses insecure rand() function for cryptographic functions

WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dbook ≫ Www::oauth SwPlatformperl Version <= 1.000
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.166
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.3 3.9 3.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

https://perldoc.perl.org/functions/rand
Third Party Advisory
https://security.metacpan.org/docs/guides/random-data-for-security.html
Third Party Advisory
https://metacpan.org/release/DBOOK/WWW-OAuth-1.000/source/lib/WWW/OAuth.pm#L86
Product
Issue Tracking
http://www.openwall.com/lists/oss-security/2026/02/13/1
Third Party Advisory
Mailing List