[<prev] [next>] [day] [month] [year] [list]
Message-ID: <c7d19401-d50a-4c63-b547-de9cc09618c9@cpansec.org>
Date: Fri, 15 May 2026 18:43:06 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-46474: Trog::TOTP versions before 1.006 for Perl generate
secrets using rand
========================================================================
CVE-2026-46474 CPAN Security Group
========================================================================
CVE ID: CVE-2026-46474
Distribution: Trog-TOTP
Versions: before 1.006
MetaCPAN: https://metacpan.org/dist/Trog-TOTP
VCS Repo: https://github.com/teodesian/Trog-TOTP
Trog::TOTP versions before 1.006 for Perl generate secrets using rand
Description
-----------
Trog::TOTP versions before 1.006 for Perl generate secrets using rand.
Secrets were generated using Perl's built-in rand function, which is
predictable and unsuitable for security usage.
Problem types
-------------
- CWE-331 Insufficient Entropy
Solutions
---------
Upgrade to version 1.006 or later.
References
----------
https://metacpan.org/release/TEODESIAN/Trog-TOTP-1.006/changes
https://metacpan.org/release/TEODESIAN/Trog-TOTP-1.006/diff/TEODESIAN/Trog-TOTP-1.005#lib/Trog/TOTP.pm
Timeline
--------
- 2026-05-13: CPANSec identified issue
- 2026-05-14: Author was notified
- 2026-05-15: Version 1.006 released.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
