CVE-2025-1828 Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions
Perl's Crypt::Random module may use insecure random number generation, weakening cryptographic security, especially on Windows systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-1828?
CVE-2025-1828 is a high-severity vulnerability in perl Crypt::Random, published on 10 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions.
If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider.
In particular, Windows versions of perl will encounter this issue by default.
Which versions are affected by CVE-2025-1828?
It affects 1 product.
Products include Timlegge Crypt\.
How do I fix CVE-2025-1828?
No fix has been published for CVE-2025-1828 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-1828 being exploited?
There is no known exploitation of CVE-2025-1828 in the wild and no public exploit code.
Other vulnerabilities in perl Crypt::Random
Sources
Also known as GHSA-jqxq-7f92-m7ww.