PT-2025-4478 · Unknown+1 · Net::Oauth+1
Gregor Herrmann
·
Published
2025-01-03
·
Updated
2025-02-13
·
CVE-2025-22376
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Net::OAuth versions prior to 0.29
Description
The default nonce in Net::OAuth::Client is a 32-bit integer generated from the built-in
rand() function, which is not cryptographically strong. This weakness can be exploited due to the use of a non-cryptographically secure pseudo-random number generator.Recommendations
For versions prior to 0.29, consider using a cryptographically secure pseudo-random number generator to generate nonces, or update to a version that uses a secure method for generating nonces. As a temporary workaround, consider disabling the use of the default nonce generation until a patch is available. Restrict access to the
Net::OAuth::Client module to minimize the risk of exploitation. Avoid using the rand() function for generating nonces in the affected API endpoints until the issue is resolved.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Net::Oauth