PT-2025-13414 · Unknown+2 · Data::Entropy+2

Robert Rothenberg · Published 2025-03-27 · Updated 2025-11-12 · CVE-2025-1860

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Data::Entropy versions 0.007 and earlier

Description The issue concerns the use of the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Recommendations For Data::Entropy versions 0.007 and earlier, consider using a cryptographically secure source of entropy instead of the default rand() function to mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-331

CWE-338

Related Identifiers

BDU:2025-08609

CVE-2025-1860

DLA-4100-1

MGASA-2025-0279

OPENSUSE-SU-2025:0123-1

OPENSUSE-SU-2025:14960-1

Affected Products

Data::Entropy

Debian

Red Os

References · 32

• https://ubuntu.com/security/CVE-2025-1860 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1860 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14960-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-1860 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4100-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08609 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-1860 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/77JMVPALVOSZWBL54FOO42D3RMLW2DLP · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0279 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-1860 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-1860 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-1860 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:0123-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0279.html · Security Note
• https://suse.com/security/cve/CVE-2025-1860.html · Note