PT-2026-21579 · Unknown+1 · Data::Random+1

Robert Rothenberg · Publicado 2026-02-23 · Atualizado 2026-03-04 · CVE-2024-58041

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Smolder versions through 1.51

Description Smolder for Perl versions through 1.51 utilizes an insecure rand() function for cryptographic operations. Specifically, Smolder::DB::Developer employs the Data::Random library, which relies on the rand() function and is intended primarily for testing purposes, not for secure cryptographic applications. The rand() function is not a cryptographically secure source of entropy.

Recommendations Versions prior to 1.52 should be updated.

Correção

Enumeração de Fraquezas

CWE-338

Identificadores relacionados

CVE-2024-58041

Produtos afetados

Data::Random

Smolder

Referências · 14

• https://twitter.com/cracbot/status/2027700421771595930 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2026153848214339917 · Publicação no Twitter
• https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537 · Nota
• https://twitter.com/cracbot/status/2027338122263204090 · Publicação no Twitter
• https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L221 · Nota
• https://twitter.com/CVEnew/status/2026184667762966553 · Publicação no Twitter
• https://twitter.com/cracbot/status/2028062735481880578 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2024-58041 · Aviso do Fabricante
• https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L5 · Nota
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Nota
• https://perldoc.perl.org/functions/rand · Nota
• https://t.me/cveNotify/152942 · Publicação no Telegram
• https://t.me/cveNotify/154052 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-58041 · Nota de Segurança