PT-2026-53857 · Cpan · Net::Bittorrent
Published
2026-06-30
·
Updated
2026-06-30
·
CVE-2026-57082
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Net::BitTorrent versions prior to 2.0.2
Description
Net::BitTorrent generates the Message Stream Encryption (MSE) Diffie-Hellman private key using a non-cryptographic Pseudo-Random Number Generator (PRNG). Specifically, the
KeyExchange.pm module derives the 160-bit private key from Perl's rand() function, which is a drand48-class generator seeded once per process. Because the shared secret and the resulting RC4 keys depend on this predictable PRNG, a passive observer can recover the PRNG state by analyzing cleartext random padding generated by the random pad function. This allows an attacker to reconstruct the private key, compute the shared secret using the peer's public key, derive the RC4 keys, and decrypt the connection, bypassing the obfuscation provided by MSE.Recommendations
Update Net::BitTorrent to a version newer than 2.0.1.
Fix
Use of Insufficiently Random Values
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Net::Bittorrent