[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <684e5604-d5f9-4373-ac83-5b70d95f3a54@deguest.jp>
Date: Wed, 15 Apr 2026 16:32:43 +0900
From: Jacques Deguest <jack@...uest.jp>
To: Robert Rothenberg <rrwo@...nsec.org>, cve-announce@...urity.metacpan.org,
oss-security@...ts.openwall.com
Subject: Re: CVE-2026-5088: Apache::API::Password versions through v0.5.2 for
Perl can generate insecure random values for salts
Thank you kindly for letting me know.
I have already corrected this with the version v0.5.3 that I released
this morning (Japan time), and that is already available on CPAN.
Kind regards,
Jacques Deguest
On 2026/04/15 16:06, Robert Rothenberg wrote:
> ========================================================================
> CVE-2026-5088 CPAN Security Group
> ========================================================================
>
> CVE ID: CVE-2026-5088
> Distribution: Apache2-API
> Versions: through v0.5.2
>
> MetaCPAN: https://metacpan.org/dist/Apache2-API
> VCS Repo: https://gitlab.com/jackdeguest/Apache2-API
>
>
> Apache::API::Password versions through v0.5.2 for Perl can generate
> insecure random values for salts
>
> Description
> -----------
> Apache::API::Password versions through v0.5.2 for Perl can generate
> insecure random values for salts.
>
> The _make_salt and _make_salt_bcrypt methods will attept to load
> Crypt::URandom and then Bytes::Random::Secure to generate random bytes
> for the salt. If those modules are unavailable, it will simply return
> 16 bytes generated with Perl's built-in rand function.
>
> The rand function is unsuitable for cryptographic use.
>
> These salts are used for password hashing.
>
> Problem types
> -------------
> - CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
>
> Workarounds
> -----------
> Install Crypt::URandom.
>
>
> Solutions
> ---------
> Upgrade to version v0.5.3 or later, and install Crypt::URandom.
>
>
> References
> ----------
> https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.3/changes
> https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.2/view/lib/Apache2/API/Password.pod
>
> https://security.metacpan.org/docs/guides/random-data-for-security.html
> https://metacpan.org/pod/Crypt::URandom
>
Content of type "text/html" skipped
Download attachment "OpenPGP_0x5F3C0261CDB2E752.asc" of type "application/pgp-keys" (23403 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
