CVE-2025-2814

Name	CVE-2025-2814
Description	Crypt::CBC versions between 1.21 and 3.04 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libcrypt-cbc-perl (PTS)	bullseye	2.33-2	vulnerable
	sid, trixie, bookworm	3.04-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libcrypt-cbc-perl	source	(unstable)	(unfixed)	unimportant

rand() fallback only where /dev/urandom is not available
https://lists.security.metacpan.org/cve-announce/msg/28699380/