PT-2025-12876 · Unknown+2 · Dbix::Class::Encodedcolumn+2

Robert Rothenberg · Published 2025-03-26 · Updated 2026-02-09 · CVE-2025-27552

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions DBIx::Class::EncodedColumn versions prior to 0.00032

Description The issue arises from the use of the rand() function, which is not cryptographically secure, to salt password hashes. This is associated with program files Crypt/Eksblowfish/Bcrypt.pm.

Recommendations For versions prior to 0.00032, consider updating to a version that uses a cryptographically secure method for salting password hashes. As a temporary workaround, consider restricting the use of password hashing functions associated with DBIx::Class::EncodedColumn until a secure update is available.

Fix

Weakness Enumeration

CWE-916

CWE-338

CWE-331

Related Identifiers

BDU:2026-03624

CVE-2025-27552

Affected Products

Dbix::Class::Encodedcolumn

Debian

Red Os

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2025-27552 · Security Note
• https://bdu.fstec.ru/vul/2026-03624 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27552 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-27552 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-27552 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-27552 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-27552 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27552 · Vendor Advisory
• https://github.com/wreis/DBIx-Class-EncodedColumn/commit/5e9e51f574f7e64e8c014e9e4f00ee8fd87a5335 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://metacpan.org/release/WREIS/DBIx-Class-EncodedColumn-0.00032/changes · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-perl-crypt-urandom-token-cve-2025-27552-8.0 · Note
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Note
• https://t.me/cveNotify/134394 · Telegram Post
• https://t.me/cvetracker/19952 · Telegram Post