cvelistv5 - CVE-2025-2814

CVE-2025-2814 (GCVE-0-2025-2814)

Vulnerability from cvelistv5 – Published: 2025-04-12 23:41 – Updated: 2025-09-05 13:21

Summary

Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.

Severity ?

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-329 - Generation of Predictable IV with CBC Mode
CWE-331 - Insufficient Entropy

Assigner

CPANSec

References

URL

Tags

	https://perldoc.perl.org/functions/rand
	https://metacpan.org/dist/Crypt-CBC/source/lib/Cr…
	https://security.metacpan.org/docs/guides/random-…
	https://github.com/lstein/Lib-Crypt-CBC/commit/37…	patch

Impacted products

	Vendor	Product	Version
	LDS	Crypt::CBC	Affected: 1.21 , ≤ 3.05 (custom)

Credits

Robert Rothenberg (RRWO)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-2814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-14T18:21:53.532777Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-338",
                "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-14T18:22:27.371Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Crypt-CBC",
          "product": "Crypt::CBC",
          "programFiles": [
            "lib/Crypt/CBC.pm"
          ],
          "repo": "https://github.com/lstein/Lib-Crypt-CBC",
          "vendor": "LDS",
          "versions": [
            {
              "lessThanOrEqual": "3.05",
              "status": "affected",
              "version": "1.21",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Robert Rothenberg (RRWO)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\u003cbr\u003e\u003cbr\u003eThis issue affects operating systems where \"/dev/urandom\u0027\" is unavailable.\u0026nbsp; In that case, Crypt::CBC will fallback to use the insecure rand() function."
            }
          ],
          "value": "Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\n\nThis issue affects operating systems where \"/dev/urandom\u0027\" is unavailable.\u00a0 In that case, Crypt::CBC will fallback to use the insecure rand() function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-338",
              "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-329",
              "description": "CWE-329 Generation of Predictable IV with CBC Mode",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-331",
              "description": "CWE-331 Insufficient Entropy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-05T13:21:32.700Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "url": "https://perldoc.perl.org/functions/rand"
        },
        {
          "url": "https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777"
        },
        {
          "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c126ebf535.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Users should update to a fixed version, or apply the patch provided in the references section, or use a patched version provided by their OS distribution"
            }
          ],
          "value": "Users should update to a fixed version, or apply the patch provided in the references section, or use a patched version provided by their OS distribution"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2025-2814",
    "datePublished": "2025-04-12T23:41:48.511Z",
    "dateReserved": "2025-03-26T13:51:26.476Z",
    "dateUpdated": "2025-09-05T13:21:32.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-2814\",\"sourceIdentifier\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\",\"published\":\"2025-04-13T00:15:14.997\",\"lastModified\":\"2025-09-05T14:15:44.323\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\\n\\nThis issue affects operating systems where \\\"/dev/urandom\u0027\\\" is unavailable.\u00a0 In that case, Crypt::CBC will fallback to use the insecure rand() function.\"},{\"lang\":\"es\",\"value\":\"Las versiones de Crypt::CBC entre la 1.21 y la 3.04 para Perl pueden usar la funci\u00f3n rand() como fuente predeterminada de entrop\u00eda, la cual no es criptogr\u00e1ficamente segura, para funciones criptogr\u00e1ficas. Este problema afecta a sistemas operativos donde \\\"/dev/urandom\u0027\\\" no est\u00e1 disponible. En ese caso, Crypt::CBC recurrir\u00e1 a la funci\u00f3n rand(), que no es segura.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":4.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.5,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-329\"},{\"lang\":\"en\",\"value\":\"CWE-331\"},{\"lang\":\"en\",\"value\":\"CWE-338\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-338\"}]}],\"references\":[{\"url\":\"https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c126ebf535.patch\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"https://perldoc.perl.org/functions/rand\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"https://security.metacpan.org/docs/guides/random-data-for-security.html\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-2814\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-14T18:21:53.532777Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-338\", \"description\": \"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-13T02:21:19.384Z\"}}], \"cna\": {\"title\": \"Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Robert Rothenberg (RRWO)\"}], \"affected\": [{\"repo\": \"https://github.com/lstein/Lib-Crypt-CBC\", \"vendor\": \"LDS\", \"product\": \"Crypt::CBC\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.21\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.05\"}], \"packageName\": \"Crypt-CBC\", \"programFiles\": [\"lib/Crypt/CBC.pm\"], \"collectionURL\": \"https://cpan.org/modules\", \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Users should update to a fixed version, or apply the patch provided in the references section, or use a patched version provided by their OS distribution\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Users should update to a fixed version, or apply the patch provided in the references section, or use a patched version provided by their OS distribution\", \"base64\": false}]}], \"references\": [{\"url\": \"https://perldoc.perl.org/functions/rand\"}, {\"url\": \"https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777\"}, {\"url\": \"https://security.metacpan.org/docs/guides/random-data-for-security.html\"}, {\"url\": \"https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c126ebf535.patch\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\\n\\nThis issue affects operating systems where \\\"/dev/urandom\u0027\\\" is unavailable.\\u00a0 In that case, Crypt::CBC will fallback to use the insecure rand() function.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\u003cbr\u003e\u003cbr\u003eThis issue affects operating systems where \\\"/dev/urandom\u0027\\\" is unavailable.\u0026nbsp; In that case, Crypt::CBC will fallback to use the insecure rand() function.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-338\", \"description\": \"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-329\", \"description\": \"CWE-329 Generation of Predictable IV with CBC Mode\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-331\", \"description\": \"CWE-331 Insufficient Entropy\"}]}], \"providerMetadata\": {\"orgId\": \"9b29abf9-4ab0-4765-b253-1875cd9b441e\", \"shortName\": \"CPANSec\", \"dateUpdated\": \"2025-09-05T13:21:32.700Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-2814\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-09-05T13:21:32.700Z\", \"dateReserved\": \"2025-03-26T13:51:26.476Z\", \"assignerOrgId\": \"9b29abf9-4ab0-4765-b253-1875cd9b441e\", \"datePublished\": \"2025-04-12T23:41:48.511Z\", \"assignerShortName\": \"CPANSec\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-2814

Vulnerability from fkie_nvd - Published: 2025-04-13 00:15 - Updated: 2025-09-05 14:15

Severity ?

4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c126ebf535.patch
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://perldoc.perl.org/functions/rand
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://security.metacpan.org/docs/guides/random-data-for-security.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\n\nThis issue affects operating systems where \"/dev/urandom\u0027\" is unavailable.\u00a0 In that case, Crypt::CBC will fallback to use the insecure rand() function."
    },
    {
      "lang": "es",
      "value": "Las versiones de Crypt::CBC entre la 1.21 y la 3.04 para Perl pueden usar la funci\u00f3n rand() como fuente predeterminada de entrop\u00eda, la cual no es criptogr\u00e1ficamente segura, para funciones criptogr\u00e1ficas. Este problema afecta a sistemas operativos donde \"/dev/urandom\u0027\" no est\u00e1 disponible. En ese caso, Crypt::CBC recurrir\u00e1 a la funci\u00f3n rand(), que no es segura."
    }
  ],
  "id": "CVE-2025-2814",
  "lastModified": "2025-09-05T14:15:44.323",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 4.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-13T00:15:14.997",
  "references": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c126ebf535.patch"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://perldoc.perl.org/functions/rand"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-329"
        },
        {
          "lang": "en",
          "value": "CWE-331"
        },
        {
          "lang": "en",
          "value": "CWE-338"
        }
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-338"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-XPFQ-7J72-X4PX

Vulnerability from github – Published: 2025-04-13 00:30 – Updated: 2025-09-05 15:31

Details

Crypt::CBC versions between 1.21 and 3.04 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.

Severity ?

4.0 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-2814"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-329",
      "CWE-338"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-13T00:15:14Z",
    "severity": "MODERATE"
  },
  "details": "Crypt::CBC versions between 1.21 and 3.04 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\n\nThis issue affects operating systems where \"/dev/urandom\u0027\" is unavailable.\u00a0 In that case, Crypt::CBC will fallback to use the insecure rand() function.",
  "id": "GHSA-xpfq-7j72-x4px",
  "modified": "2025-09-05T15:31:06Z",
  "published": "2025-04-13T00:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2814"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c126ebf535.patch"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777"
    },
    {
      "type": "WEB",
      "url": "https://perldoc.perl.org/functions/rand"
    },
    {
      "type": "WEB",
      "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

OPENSUSE-SU-2025:15495-1

Vulnerability from csaf_opensuse - Published: 2025-08-27 00:00 - Updated: 2025-08-27 00:00

Summary

perl-Crypt-CBC-3.70.0-1.1 on GA media

Notes

Title of the patch

perl-Crypt-CBC-3.70.0-1.1 on GA media

Description of the patch

These are all security issues fixed in the perl-Crypt-CBC-3.70.0-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2025-15495

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "perl-Crypt-CBC-3.70.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the perl-Crypt-CBC-3.70.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15495",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15495-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-2814 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-2814/"
      }
    ],
    "title": "perl-Crypt-CBC-3.70.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-08-27T00:00:00Z",
      "generator": {
        "date": "2025-08-27T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15495-1",
      "initial_release_date": "2025-08-27T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-08-27T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Crypt-CBC-3.70.0-1.1.aarch64",
                "product": {
                  "name": "perl-Crypt-CBC-3.70.0-1.1.aarch64",
                  "product_id": "perl-Crypt-CBC-3.70.0-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Crypt-CBC-3.70.0-1.1.ppc64le",
                "product": {
                  "name": "perl-Crypt-CBC-3.70.0-1.1.ppc64le",
                  "product_id": "perl-Crypt-CBC-3.70.0-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Crypt-CBC-3.70.0-1.1.s390x",
                "product": {
                  "name": "perl-Crypt-CBC-3.70.0-1.1.s390x",
                  "product_id": "perl-Crypt-CBC-3.70.0-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Crypt-CBC-3.70.0-1.1.x86_64",
                "product": {
                  "name": "perl-Crypt-CBC-3.70.0-1.1.x86_64",
                  "product_id": "perl-Crypt-CBC-3.70.0-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Crypt-CBC-3.70.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.aarch64"
        },
        "product_reference": "perl-Crypt-CBC-3.70.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Crypt-CBC-3.70.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.ppc64le"
        },
        "product_reference": "perl-Crypt-CBC-3.70.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Crypt-CBC-3.70.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.s390x"
        },
        "product_reference": "perl-Crypt-CBC-3.70.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Crypt-CBC-3.70.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.x86_64"
        },
        "product_reference": "perl-Crypt-CBC-3.70.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-2814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-2814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\n\nThis issue affects operating systems where \"/dev/urandom\u0027\" is unavailable.   In that case, Crypt::CBC will fallback to use the insecure rand() function.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-2814",
          "url": "https://www.suse.com/security/cve/CVE-2025-2814"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241141 for CVE-2025-2814",
          "url": "https://bugzilla.suse.com/1241141"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Crypt-CBC-3.70.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-27T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-2814"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-2814 (GCVE-0-2025-2814)

FKIE_CVE-2025-2814

GHSA-XPFQ-7J72-X4PX

OPENSUSE-SU-2025:15495-1

Tags

Sightings

Nomenclature