PT-2025-14484 · Unknown · Crypt::Salt

Robert Rothenberg · Published 2025-04-02 · Updated 2025-04-02 · CVE-2025-1805

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Crypt::Salt for Perl version 0.01

Description The issue concerns the use of an insecure rand() function when generating salts for cryptographic purposes. This could potentially lead to weaknesses in the cryptographic mechanisms that rely on these salts.

Recommendations For Crypt::Salt for Perl version 0.01, consider using a more secure random number generator to mitigate the risk associated with the insecure rand() function. As a temporary workaround, restrict the use of the rand() function in cryptographic contexts until a more secure alternative is implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2025-1805

Affected Products

Crypt::Salt

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-1805 · Security Note
• https://t.me/cvedetector/21873 · Telegram Post
• https://t.me/cvetracker/20572 · Telegram Post
• https://perldoc.perl.org/functions/rand · Note
• https://metacpan.org/release/HACHI/Crypt-Salt-0.01/source/lib/Crypt/Salt.pm#L76 · Note
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Note
• https://t.me/cvenotify/117333 · Telegram Post
• https://twitter.com/CVEnew/status/1907551253271556549 · Twitter Post