CVE-2002-20002

Published: Jan 2, 2025Modified: Jan 2, 2025

5.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Exploitability: 2.2 / Impact: 2.7

Source: MITRE (Secondary)

Description

The Net::EasyTCP package before 0.15 for Perl always uses Perl's builtin rand(), which is not a strong random number generator, for cryptographic keys.

Related CWEs

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

References (3)

https://github.com/briandfoy/cpan-security-advisory/issues/184

Source: cve@mitre.org

https://metacpan.org/release/MNAGUIB/EasyTCP-0.15/view/EasyTCP.pm

Source: cve@mitre.org

https://metacpan.org/release/MNAGUIB/EasyTCP-0.26/changes

Source: cve@mitre.org

Timeline

No history available yet.