[<prev] [day] [month] [year] [list]
Message-ID: <8bbe89c1-a955-4334-8da9-67b4c131e293@cpansec.org>
Date: Tue, 26 May 2026 23:55:30 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-8647: Crypt::ScryptKDF versions through 0.010 for Perl uses
insecure random number source when no CSPRNG module is available
========================================================================
CVE-2026-8647 CPAN Security Group
========================================================================
CVE ID: CVE-2026-8647
Distribution: Crypt-ScryptKDF
Versions: through 0.010
MetaCPAN: https://metacpan.org/dist/Crypt-ScryptKDF
VCS Repo: https://github.com/DCIT/perl-Crypt-ScryptKDF
Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random
number source when no CSPRNG module is available
Description
-----------
Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random
number source when no CSPRNG module is available.
The random_bytes function fell back to using the built-in rand()
function when none of the Perl modules Crypt::PRNG,
Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or
Bytes::Random::Secure were available.
Problem types
-------------
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Workarounds
-----------
Install one of the recommended Perl modules, such as Crypt::PRNG.
Solutions
---------
Upgrade to version 0.011 or later.
References
----------
https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/changes
https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/diff/MIK/Crypt-ScryptKDF-0.010#lib/Crypt/ScryptKDF.pm
Timeline
--------
- 2026-05-13: Issue reported to CPANSec
- 2026-05-14: Issue reported to maintainer
- 2026-05-16: Version 0.011 with fix released.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
