Log in Start free

Vulnerability · Published Apr 12, 2025 · Assigned by CPANSec

CVE-2025-2814Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions

Medium 4.0

In plain English

A medium-severity security flaw in Crypt::CBC from LDS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.0Medium
Exploit odds (30 days)0.2%top 89.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable.  In that case, Crypt::CBC will fallback to use the insecure rand() function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libcrypt-cbc-perlno fix listedDEBIAN-CVE-2025-2814
Debian:13libcrypt-cbc-perlno fix listedDEBIAN-CVE-2025-2814
Debian:14libcrypt-cbc-perl3.07-1DEBIAN-CVE-2025-2814
Ubuntu:22.04:LTSlibcrypt-cbc-perlno fix listedUBUNTU-CVE-2025-2814
Ubuntu:24.04:LTSlibcrypt-cbc-perlno fix listedUBUNTU-CVE-2025-2814
Ubuntu:25.10libcrypt-cbc-perlno fix listedUBUNTU-CVE-2025-2814
Ubuntu:26.04:LTSlibcrypt-cbc-perlno fix listedUBUNTU-CVE-2025-2814
Ubuntu:26.10libcrypt-cbc-perlno fix listedUBUNTU-CVE-2025-2814

Affected products (as reported)

VendorProductVersions
LDS Crypt::CBC 1.21 – through 3.05

Weakness: CWE-338, CWE-329, CWE-331 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References