CWE-331
AllowedInsufficient Entropy
Abstraction: Base · Status: Draft
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
227 vulnerabilities reference this CWE, most recent first.
GHSA-8CJC-9G75-5FR7
Vulnerability from github – Published: 2026-01-29 21:30 – Updated: 2026-03-09 18:31A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successful exploitation requires network proximity but no authentication, and may result in high impact to confidentiality, integrity, and availability of transmitted data.
{
"affected": [],
"aliases": [
"CVE-2025-13399"
],
"database_specific": {
"cwe_ids": [
"CWE-331"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-29T19:16:10Z",
"severity": "HIGH"
},
"details": "A weakness in the web interface\u2019s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successful exploitation requires network proximity but no authentication, and may result in high impact to confidentiality, integrity, and availability of transmitted data.",
"id": "GHSA-8cjc-9g75-5fr7",
"modified": "2026-03-09T18:31:36Z",
"published": "2026-01-29T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13399"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/de/support/download/vx800v/#Firmware"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/us/support/faq/4930"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8JH5-PC7C-26PC
Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce.
{
"affected": [],
"aliases": [
"CVE-2021-33027"
],
"database_specific": {
"cwe_ids": [
"CWE-331"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-19T12:15:00Z",
"severity": "CRITICAL"
},
"details": "Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce.",
"id": "GHSA-8jh5-pc7c-26pc",
"modified": "2022-05-24T19:08:24Z",
"published": "2022-05-24T19:08:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33027"
},
{
"type": "WEB",
"url": "https://medium.com/sylabs"
},
{
"type": "WEB",
"url": "https://support.sylabs.io/a/solutions/articles/42000086439"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8Q6V-474H-WHGG
Vulnerability from github – Published: 2025-08-06 17:11 – Updated: 2025-08-07 15:11Impact
A protocol compliance bug in thinbus-srp-npm versions prior to 2.0.1 causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). RFC 5054 states in section 2.5.4 Client Key Exchange
The client key exchange message carries the client's public value (A). The client calculates this value as A = g^a % N, where a is a random number that SHOULD be at least 256 bits in length.
The client public value is being generated from a private value that is 4 bits below the specification. This reduces the protocol's designed security margin it is now practically exploitable. The servers full sized 2048 bit random number is used to create the shared session key and password proof.
Patches
The issue is fixed in versions >= 2.0.1
Workarounds
It is possible to patch a legacy version:
// WRONG
var hexLength = this.toHex(N).length;
// CORRECT
var hexLength = this.toHex(this.N()).length;
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "thinbus-srp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-54885"
],
"database_specific": {
"cwe_ids": [
"CWE-331"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-06T17:11:42Z",
"nvd_published_at": "2025-08-07T01:15:26Z",
"severity": "MODERATE"
},
"details": "### Impact\nA protocol compliance bug in thinbus-srp-npm versions prior to 2.0.1 causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). RFC 5054 states in section [2.5.4 Client Key Exchange ](https://datatracker.ietf.org/doc/html/rfc5054#section-2.5.4)\n\n\u003e The client key exchange message carries the client\u0027s public value\n (A). The client calculates this value as A = g^a % N, where a is a\n random number that SHOULD be at least 256 bits in length.\n\nThe client public value is being generated from a private value that is 4 bits below the specification. This reduces the protocol\u0027s designed security margin it is now practically exploitable. The servers full sized 2048 bit random number is used to create the shared session key and password proof. \n\n### Patches\n\nThe issue is fixed in versions \u003e= 2.0.1\n\n### Workarounds\n\nIt is possible to patch a legacy version: \n\n```javascript\n// WRONG\nvar hexLength = this.toHex(N).length;\n\n// CORRECT \nvar hexLength = this.toHex(this.N()).length;\n```",
"id": "GHSA-8q6v-474h-whgg",
"modified": "2025-08-07T15:11:48Z",
"published": "2025-08-06T17:11:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/simbo1905/thinbus-srp-npm/security/advisories/GHSA-8q6v-474h-whgg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54885"
},
{
"type": "WEB",
"url": "https://github.com/simbo1905/thinbus-srp-npm/issues/28"
},
{
"type": "WEB",
"url": "https://github.com/simbo1905/thinbus-srp-npm/pull/30/commits/4aeaea2366e090765a8204059c7bcf3616438d31"
},
{
"type": "WEB",
"url": "https://github.com/simbo1905/thinbus-srp-npm/commit/aa7064c1db7294ce867e9bc92f26fa6c71a5a2cb"
},
{
"type": "PACKAGE",
"url": "https://github.com/simbo1905/thinbus-srp-npm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended"
}
GHSA-8VQ8-VJQP-8V4R
Vulnerability from github – Published: 2023-08-15 21:30 – Updated: 2025-11-04 18:30Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection
{
"affected": [],
"aliases": [
"CVE-2023-4344"
],
"database_specific": {
"cwe_ids": [
"CWE-330",
"CWE-331"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-15T19:15:11Z",
"severity": "CRITICAL"
},
"details": "Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection",
"id": "GHSA-8vq8-vjqp-8v4r",
"modified": "2025-11-04T18:30:42Z",
"published": "2023-08-15T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4344"
},
{
"type": "WEB",
"url": "https://www.broadcom.com/support/resources/product-security-center"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8XHV-GQM4-3W99
Vulnerability from github – Published: 2024-06-07 22:26 – Updated: 2024-06-07 22:26We discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls:
Zend_Ldap_Attribute::createPassword
Zend_Form_Element_Hash::_generateHash
Zend_Gdata_HttpClient::filterHttpRequest
Zend_Filter_Encrypt_Mcrypt::_srand
Zend_OpenId::randomBytes
In each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.
Moreover, we discovered a potential security issue in the usage of the openssl_random_pseudo_bytes() function in Zend_Crypt_Math::randBytes, reported in PHP BUG #70014, and the security implications reported in a discussion on the random_compat library.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendframework1"
},
"ranges": [
{
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.12.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-331"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-07T22:26:25Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "We discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls:\n```\nZend_Ldap_Attribute::createPassword\nZend_Form_Element_Hash::_generateHash\nZend_Gdata_HttpClient::filterHttpRequest\nZend_Filter_Encrypt_Mcrypt::_srand\nZend_OpenId::randomBytes\n```\nIn each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.\n\nMoreover, we discovered a potential security issue in the usage of the [openssl_random_pseudo_bytes()](http://php.net/manual/en/function.openssl-random-pseudo-bytes.php) function in Zend_Crypt_Math::randBytes, reported in PHP BUG [#70014](https://bugs.php.net/bug.php?id=70014), and the security implications reported in a discussion [on the random_compat library.](https://github.com/paragonie/random_compat/issues/96)",
"id": "GHSA-8xhv-gqm4-3w99",
"modified": "2024-06-07T22:26:25Z",
"published": "2024-06-07T22:26:25Z",
"references": [
{
"type": "WEB",
"url": "https://framework.zend.com/security/advisory/ZF2016-01"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2016-01.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/zendframework/zf1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "ZendFramework1 Potential Insufficient Entropy Vulnerability"
}
GHSA-949R-2WPH-553M
Vulnerability from github – Published: 2022-04-30 18:17 – Updated: 2024-02-15 03:30ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate session tokens for HSMs using the C rand function, or (2) generate certificates or keys using /dev/urandom instead of another source which blocks when the entropy pool is low, which could make it easier for local or remote attackers to steal tokens or certificates via brute force guessing.
{
"affected": [],
"aliases": [
"CVE-2001-0950"
],
"database_specific": {
"cwe_ids": [
"CWE-331"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2001-12-04T05:00:00Z",
"severity": "HIGH"
},
"details": "ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate session tokens for HSMs using the C rand function, or (2) generate certificates or keys using /dev/urandom instead of another source which blocks when the entropy pool is low, which could make it easier for local or remote attackers to steal tokens or certificates via brute force guessing.",
"id": "GHSA-949r-2wph-553m",
"modified": "2024-02-15T03:30:18Z",
"published": "2022-04-30T18:17:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-0950"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/7651"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/7653"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=100749428517090\u0026w=2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/3618"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/3620"
},
{
"type": "WEB",
"url": "http://www.valicert.com/support/security_advisory_eva.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-97W9-GCC7-VR8G
Vulnerability from github – Published: 2022-11-16 12:00 – Updated: 2023-07-19 19:58A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may be used. The name of the patch is 3daa804d5f56c55b3ae13bfac368bb84ec632193. It is recommended to apply a patch to fix this issue. The identifier VDB-213717 was assigned to this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpservermon/phpservermon"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-4240"
],
"database_specific": {
"cwe_ids": [
"CWE-1241",
"CWE-330",
"CWE-331"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-07T19:27:56Z",
"nvd_published_at": "2022-11-15T23:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function `generatePasswordResetToken` of the file `src/psm/Service/User.php`. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may be used. The name of the patch is 3daa804d5f56c55b3ae13bfac368bb84ec632193. It is recommended to apply a patch to fix this issue. The identifier VDB-213717 was assigned to this vulnerability.",
"id": "GHSA-97w9-gcc7-vr8g",
"modified": "2023-07-19T19:58:50Z",
"published": "2022-11-16T12:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4240"
},
{
"type": "WEB",
"url": "https://github.com/phpservermon/phpservermon/commit/3daa804d5f56c55b3ae13bfac368bb84ec632193"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpservermon/phpservermon"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/2-phpservermon/phpservermon"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.213717"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Insufficient Entropy in PHPServerMon PRNG"
}
GHSA-9HC7-6W9R-WJ94
Vulnerability from github – Published: 2024-06-04 18:40 – Updated: 2024-06-17 15:09Reduced entropy due to inadequate character set usage
Description
Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the nano_id::base62 and nano_id::base58 functions. Specifically, the base62 function used a character set of 32 symbols instead of the intended 62 symbols, and the base58 function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the nano_id::gen macro is also affected when a custom character set that is not a power of 2 in size is specified.
It should be noted that nano_id::base64 is not affected by this vulnerability.
Impact
This can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers.
Patches
The flaws were corrected in commit a9022772b2f1ce38929b5b81eccc670ac9d3ab23 by updating the the nano_id::gen macro to use all specified characters correctly.
PoC
use std::collections::BTreeSet;
fn main() {
test_base58();
test_base62();
}
fn test_base58() {
let mut produced_symbols = BTreeSet::new();
for _ in 0..100_000 {
let id = nano_id::base58::<10>();
for c in id.chars() {
produced_symbols.insert(c);
}
}
println!(
"{} symbols generated from nano_id::base58",
produced_symbols.len()
);
}
fn test_base62() {
let mut produced_symbols = BTreeSet::new();
for _ in 0..100_000 {
let id = nano_id::base62::<10>();
for c in id.chars() {
produced_symbols.insert(c);
}
}
println!(
"{} symbols generated from nano_id::base62",
produced_symbols.len()
);
}
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "nano-id"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-36400"
],
"database_specific": {
"cwe_ids": [
"CWE-331"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-04T18:40:34Z",
"nvd_published_at": "2024-06-04T15:15:46Z",
"severity": "CRITICAL"
},
"details": "# Reduced entropy due to inadequate character set usage\n\n## Description\n\nAffected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62 symbols, and the `base58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen` macro is also affected when a custom character set that is not a power of 2 in size is specified.\n\nIt should be noted that `nano_id::base64` is not affected by this vulnerability.\n\n## Impact\n\nThis can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers.\n\n## Patches\n\nThe flaws were corrected in commit [a9022772b2f1ce38929b5b81eccc670ac9d3ab23](https://github.com/viz-rs/nano-id/commit/a9022772b2f1ce38929b5b81eccc670ac9d3ab23) by updating the the `nano_id::gen` macro to use all specified characters correctly.\n\n## PoC\n\n```rust\nuse std::collections::BTreeSet;\n\nfn main() {\n test_base58();\n test_base62();\n}\n\nfn test_base58() {\n let mut produced_symbols = BTreeSet::new();\n\n for _ in 0..100_000 {\n let id = nano_id::base58::\u003c10\u003e();\n for c in id.chars() {\n produced_symbols.insert(c);\n }\n }\n\n println!(\n \"{} symbols generated from nano_id::base58\",\n produced_symbols.len()\n );\n}\n\nfn test_base62() {\n let mut produced_symbols = BTreeSet::new();\n\n for _ in 0..100_000 {\n let id = nano_id::base62::\u003c10\u003e();\n for c in id.chars() {\n produced_symbols.insert(c);\n }\n }\n\n println!(\n \"{} symbols generated from nano_id::base62\",\n produced_symbols.len()\n );\n}\n```",
"id": "GHSA-9hc7-6w9r-wj94",
"modified": "2024-06-17T15:09:50Z",
"published": "2024-06-04T18:40:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/viz-rs/nano-id/security/advisories/GHSA-9hc7-6w9r-wj94"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36400"
},
{
"type": "WEB",
"url": "https://github.com/viz-rs/nano-id/commit/a9022772b2f1ce38929b5b81eccc670ac9d3ab23"
},
{
"type": "PACKAGE",
"url": "https://github.com/viz-rs/nano-id"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0343.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Unable to generate the correct character set"
}
GHSA-9QM9-MGQ3-X66P
Vulnerability from github – Published: 2022-07-12 00:00 – Updated: 2022-07-19 00:00Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Management Error Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2020-29505"
],
"database_specific": {
"cwe_ids": [
"CWE-331"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-11T20:15:00Z",
"severity": "HIGH"
},
"details": "Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite,\nversions before 4.5.2, contain a Key Management Error Vulnerability.",
"id": "GHSA-9qm9-mgq3-x66p",
"modified": "2022-07-19T00:00:25Z",
"published": "2022-07-12T00:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29505"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9X23-XCRX-FQ3Q
Vulnerability from github – Published: 2025-03-26 12:30 – Updated: 2025-03-26 21:31DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.
This vulnerability is associated with program files Crypt/Eksblowfish/Bcrypt.pm.
This issue affects DBIx::Class::EncodedColumn until 0.00032.
{
"affected": [],
"aliases": [
"CVE-2025-27552"
],
"database_specific": {
"cwe_ids": [
"CWE-331",
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-26T11:15:39Z",
"severity": "MODERATE"
},
"details": "DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.\n\nThis vulnerability is associated with program files Crypt/Eksblowfish/Bcrypt.pm.\n\nThis issue affects DBIx::Class::EncodedColumn until 0.00032.",
"id": "GHSA-9x23-xcrx-fq3q",
"modified": "2025-03-26T21:31:06Z",
"published": "2025-03-26T12:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27552"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/WREIS/DBIx-Class-EncodedColumn-0.00032/changes"
},
{
"type": "WEB",
"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.