CVE-2025-40905

Опубликовано: 13 фев. 2026

Источник: nvd

CVSS3: 7.3

EPSS Низкий

Описание

WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Ссылки

https://metacpan.org/release/DBOOK/WWW-OAuth-1.000/source/lib/WWW/OAuth.pm#L86
Issue Tracking
Product
https://perldoc.perl.org/functions/rand
Third Party Advisory
https://security.metacpan.org/docs/guides/random-data-for-security.html
Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/02/13/1
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:dbook:www\:\:oauth:*:*:*:*:*:perl:*:*

Версия до 1.000 (включая)

EPSS

Процентиль: 17%

0.00255

Низкий

7.3 High

CVSS3

Дефекты

CWE-338

Связанные уязвимости

CVE-2025-40905

CVSS3: 7.3

ubuntu

7 месяцев назад

WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

CVE-2025-40905

CVSS3: 7.3

debian

7 месяцев назад

WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the ...

GHSA-869w-qxf5-5q39

CVSS3: 7.3

github

7 месяцев назад

WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

EPSS

Процентиль: 17%

0.00255

Низкий

7.3 High

CVSS3

Дефекты

CWE-338