| Name | CVE-2018-25107 |
| Description | The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of random bits. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| libcrypt-random-source-perl (PTS) | bullseye | 0.14-1 | fixed |
| forky, sid, bookworm, trixie | 0.14-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| libcrypt-random-source-perl | source | (unstable) | 0.14-1 |
https://github.com/karenetheridge/Crypt-Random-Source/pull/3
Fixed by: https://github.com/karenetheridge/Crypt-Random-Source/commit/a8d581af45f74a29aeb5d864c1cb6f50740dfa2f (v0.13)