CVE-2025-1828 - CVE House
Back to Database
Status published Unknown CVE-2025-1828

Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions

Vulnerability Description

Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider. In particular, Windows versions of perl will encounter this issue by default.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-1828

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Robert Rothenberg (RRWO)

References

More from perl

View All →
CVE-2025-40909
Perl threads have a working directory race condition where file operations may target unintended paths
Unknown 0
CVE-2024-56406
Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
Unknown 0
CVE-2022-48522
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based...
Critical 9.8
CVE-2020-16156
CPAN 2.28 allows Signature Verification Bypass....
High 7.8
CVE-2020-12723
regcomp.c in Perl before 5.30.3 allows a buffer overflow via...
High 7.5

Affected Vendor

Affected Software

Crypt::Random
Vulnerable Versions:
1.05

Timeline

Official Publish: March 10th, 2025
Last Modified: September 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-338 CWE-331

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.