Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Bytes::Random::Secure by DAVIDO

    CVE-2026-11625 (GCVE-0-2026-11625)

    Vulnerability from nvd – Published: 2026-06-26 08:07 – Updated: 2026-07-01 14:34
    VLAI
    Title
    Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
    Summary
    Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-335 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
    Assigner
    References
    Impacted products
    Vendor Product Version
    DAVIDO Bytes::Random::Secure Affected: 0 , ≤ 0.29 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-11625",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T16:14:14.671944Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T16:14:22.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Bytes-Random-Secure",
          "product": "Bytes::Random::Secure",
          "programFiles": [
            "lib/Bytes/Random/Secure.pm"
          ],
          "repo": "https://github.com/daoswald/Bytes-Random-Secure",
          "vendor": "DAVIDO",
          "versions": [
            {
              "lessThanOrEqual": "0.29",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.\n\nWhen an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.\n\nSecrets generated in multiprocess applications are predictable across processes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-335",
              "description": "CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-01T14:34:43.953Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/daoswald/Bytes-Random-Secure/issues/3"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/daoswald/Bytes-Random-Secure/pull/4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://security.metacpan.org/patches/B/Bytes-Random-Secure/0.29/CVE-2026-11625-r1.patch"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11702"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41564"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-26T00:00:00.000Z",
          "value": "Issue reported to CPANSec."
        },
        {
          "lang": "en",
          "time": "2026-06-08T00:00:00.000Z",
          "value": "Maintainer notified."
        },
        {
          "lang": "en",
          "time": "2026-06-24T00:00:00.000Z",
          "value": "Issue publicly reported on GitHub."
        },
        {
          "lang": "en",
          "time": "2026-06-30T00:00:00.000Z",
          "value": "Patch merged."
        }
      ],
      "title": "Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes",
      "workarounds": [
        {
          "lang": "en",
          "value": "Apply the patch.\n\nOtherwise, only use the object-oriented interface and ensure that the object is only instantiated in a child process after forking.\n\nAlternatively, use a different module such as Crypt::PRNG, Crypt::SysRandom or Crypt::URandom."
        }
      ],
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-11625",
    "datePublished": "2026-06-26T08:07:30.141Z",
    "dateReserved": "2026-06-08T21:02:09.596Z",
    "dateUpdated": "2026-07-01T14:34:43.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-11625 (GCVE-0-2026-11625)

    Vulnerability from cvelistv5 – Published: 2026-06-26 08:07 – Updated: 2026-07-01 14:34
    VLAI
    Title
    Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
    Summary
    Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-335 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
    Assigner
    References
    Impacted products
    Vendor Product Version
    DAVIDO Bytes::Random::Secure Affected: 0 , ≤ 0.29 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-11625",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T16:14:14.671944Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T16:14:22.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Bytes-Random-Secure",
          "product": "Bytes::Random::Secure",
          "programFiles": [
            "lib/Bytes/Random/Secure.pm"
          ],
          "repo": "https://github.com/daoswald/Bytes-Random-Secure",
          "vendor": "DAVIDO",
          "versions": [
            {
              "lessThanOrEqual": "0.29",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.\n\nWhen an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.\n\nSecrets generated in multiprocess applications are predictable across processes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-335",
              "description": "CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-01T14:34:43.953Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/daoswald/Bytes-Random-Secure/issues/3"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/daoswald/Bytes-Random-Secure/pull/4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://security.metacpan.org/patches/B/Bytes-Random-Secure/0.29/CVE-2026-11625-r1.patch"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11702"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41564"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-26T00:00:00.000Z",
          "value": "Issue reported to CPANSec."
        },
        {
          "lang": "en",
          "time": "2026-06-08T00:00:00.000Z",
          "value": "Maintainer notified."
        },
        {
          "lang": "en",
          "time": "2026-06-24T00:00:00.000Z",
          "value": "Issue publicly reported on GitHub."
        },
        {
          "lang": "en",
          "time": "2026-06-30T00:00:00.000Z",
          "value": "Patch merged."
        }
      ],
      "title": "Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes",
      "workarounds": [
        {
          "lang": "en",
          "value": "Apply the patch.\n\nOtherwise, only use the object-oriented interface and ensure that the object is only instantiated in a child process after forking.\n\nAlternatively, use a different module such as Crypt::PRNG, Crypt::SysRandom or Crypt::URandom."
        }
      ],
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-11625",
    "datePublished": "2026-06-26T08:07:30.141Z",
    "dateReserved": "2026-06-08T21:02:09.596Z",
    "dateUpdated": "2026-07-01T14:34:43.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}