> DESCRIPTION
Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available.
The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.
> CWE DETAILED DESCRIPTIONS
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
> GITHUB SECURITY ADVISORY
GHSA-hrr3-gc8f-f4qj
MODERATE
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
AFFECTED PACKAGES:
NPM / fast-uri
>= 4.0.0, < 4.1.5
Fixed in: 4.1.5
NPM / fast-uri
>= 3.0.0, < 3.1.8
Fixed in: 3.1.8
NPM / fast-uri
< 2.4.7
Fixed in: 2.4.7