PUBLISHED
2026-04-15 08:16
MODIFIED
2026-04-15 08:16
EPSS (Prob. Exploit)
0.57%
Top 52.5%
> DESCRIPTION
Apache::API::Password versions through v0.5.2 for Perl can generate insecure random values for salts.
The _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply return 16 bytes generated with Perl's built-in rand function.
The rand function is unsuitable for cryptographic use.
These salts are used for password hashing.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
> GITHUB SECURITY ADVISORY
GHSA-gmxh-hjfv-qc2w
HIGH
Koillection has an authenticated Server-Side Request Forgery issue
AFFECTED PACKAGES:
COMPOSER / koillection/koillection
< 1.8.4
Fixed in: 1.8.4
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts
AFFECTED PACKAGES:
Unknown / Unknown
1 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
15/04/2026 08:16
Source: NVD
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptogra...
Total des modifications: 1
Dernière mise à jour: 6 months ago