Description (CNA)
Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys. Amazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object. Before version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| BIGFOOT / Amazon::Credentials | affected 0 through 1.2.0 |
CWE
CWE-338
References
- https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.2.0/source/lib/Amazon/Credentials.pm#L1415-1418
- https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.3.0/changes
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.