CVE-2024-56370

Published: Apr 5, 2025Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.

Related CWEs

Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

References (5)

https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://metacpan.org/release/ELLIOTT/Net-Xero-0.44/source/lib/Net/Xero.pm#L58

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://metacpan.org/release/ELLIOTT/Net-Xero-0.44/source/lib/Net/Xero.pm#L9

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://perldoc.perl.org/functions/rand

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://security.metacpan.org/docs/guides/random-data-for-security.html

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Timeline

No history available yet.