WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
References
| Link | Resource |
|---|---|
| https://metacpan.org/release/DBOOK/WWW-OAuth-1.000/source/lib/WWW/OAuth.pm#L86 | Issue Tracking Product |
| https://perldoc.perl.org/functions/rand | Third Party Advisory |
| https://security.metacpan.org/docs/guides/random-data-for-security.html | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/02/13/1 | Mailing List Third Party Advisory |
Configurations
History
No history.
Information
Published : 2026-02-13 00:16
Updated : 2026-03-10 17:07
NVD link : CVE-2025-40905
Mitre link : CVE-2025-40905
CVE.ORG link : CVE-2025-40905
JSON object : View
Products Affected
dbook
- www\
CWE
CWE-338
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)