[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <7ffc338d-5285-444f-87fd-0c86a5672fe8@cpansec.org>
Date: Wed, 15 Apr 2026 08:06:00 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-5088: Apache::API::Password versions through v0.5.2 for Perl
can generate insecure random values for salts
========================================================================
CVE-2026-5088 CPAN Security Group
========================================================================
CVE ID: CVE-2026-5088
Distribution: Apache2-API
Versions: through v0.5.2
MetaCPAN: https://metacpan.org/dist/Apache2-API
VCS Repo: https://gitlab.com/jackdeguest/Apache2-API
Apache::API::Password versions through v0.5.2 for Perl can generate
insecure random values for salts
Description
-----------
Apache::API::Password versions through v0.5.2 for Perl can generate
insecure random values for salts.
The _make_salt and _make_salt_bcrypt methods will attept to load
Crypt::URandom and then Bytes::Random::Secure to generate random bytes
for the salt. If those modules are unavailable, it will simply return
16 bytes generated with Perl's built-in rand function.
The rand function is unsuitable for cryptographic use.
These salts are used for password hashing.
Problem types
-------------
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Workarounds
-----------
Install Crypt::URandom.
Solutions
---------
Upgrade to version v0.5.3 or later, and install Crypt::URandom.
References
----------
https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.3/changes
https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.2/view/lib/Apache2/API/Password.pod
https://security.metacpan.org/docs/guides/random-data-for-security.html
https://metacpan.org/pod/Crypt::URandom
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
