[<prev] [next>] [day] [month] [year] [list]
Message-ID: <336aa718-600f-41dd-8f11-4fac99dd8755@cpansec.org>
Date: Sat, 28 Mar 2026 18:50:11 +0000
From: Robert Rothenberg <rrwo@...nsec.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-15604: Amon2 versions before 6.17 for Perl use an insecure
random_string implementation for security functions
========================================================================
CVE-2025-15604 CPAN Security Group
========================================================================
CVE ID: CVE-2025-15604
Distribution: Amon2
Versions: before 6.17
MetaCPAN: https://metacpan.org/dist/Amon2
VCS Repo: https://github.com/tokuhirom/Amon
Amon2 versions before 6.17 for Perl use an insecure random_string
implementation for security functions
Description
-----------
Amon2 versions before 6.17 for Perl use an insecure random_string
implementation for security functions.
In versions 6.06 through 6.16, the random_string function will attempt
to read bytes from the /dev/urandom device, but if that is unavailable
then it generates bytes by concatenating a SHA-1 hash seeded with the
built-in rand() function, the PID, and the high resolution epoch time.
The PID will come from a small set of numbers, and the epoch time may
be guessed, if it is not leaked from the HTTP Date header. The built-in
rand function is unsuitable for cryptographic usage.
Before version 6.06, there was no fallback when /dev/urandom was not
available.
Before version 6.04, the random_string function used the built-in
rand() function to generate a mixed-case alphanumeric string.
This function may be used for generating session ids, generating
secrets for signing or encrypting cookie session data and generating
tokens used for Cross Site Request Forgery (CSRF) protection.
Problem types
-------------
- CWE-340 Generation of Predictable Numbers or Identifiers
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Solutions
---------
Upgrade to Amon2 version 6.17 or later.
References
----------
https://metacpan.org/release/TOKUHIROM/Amon2-6.17/diff/TOKUHIROM/Amon2-6.16#lib/Amon2/Util.pm
https://metacpan.org/release/TOKUHIROM/Amon2-6.17/changes
https://github.com/tokuhirom/Amon/pull/135
https://security.metacpan.org/docs/guides/random-data-for-security.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
