CVE-2025-27552

Name	CVE-2025-27552
Description	DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files Crypt/Eksblowfish/Bcrypt.pm. This issue affects DBIx::Class::EncodedColumn until 0.00032.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libdbix-class-encodedcolumn-perl (PTS)	bullseye	0.00020-1	vulnerable
	bookworm	0.00020-2	vulnerable
	forky, sid, trixie	0.00020-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libdbix-class-encodedcolumn-perl	source	(unstable)	0.00020-3

Notes

[bookworm] - libdbix-class-encodedcolumn-perl <ignored> (Minor issue, too intrusive to backport)
[bullseye] - libdbix-class-encodedcolumn-perl <postponed> (Minor issue, leaf package, fix requires libcrypt-urandom-token-perl or a replacement)
https://github.com/wreis/DBIx-Class-EncodedColumn/commit/5e9e51f574f7e64e8c014e9e4f00ee8fd87a5335 (0.11)