Description (CNA)
Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available. The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| MIK / Crypt::ScryptKDF | affected 0 through 0.010 |
CWE
CWE-338
References
- https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/changes
- https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/diff/MIK/Crypt-ScryptKDF-0.010#lib/Crypt/ScryptKDF.pm
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.