CVE-2025-1860

Data::Entropy for Perl uses insecure rand() function for cryptographic functions

7.7 HighFix available

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.19%Up 0.2 points since Mar 28, 2025

What each source reports

CVE List Score used 7.7

Data::Entropy for Perl uses insecure rand() function for cryptographic functions

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Record: CVE-2025-1860
CVSS 3.1: 7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-338, CWE-331
Updated: 2026-11-02

EUVDEUVD-2025-8533 7.7

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Record: EUVD-2025-8533
CVSS 3.1: 7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-g3hm-j3wc-jcg9 7.7

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy...

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Record: GHSA-g3hm-j3wc-jcg9
CVSS 3.1: 7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-331, CWE-338
Updated: 2026-11-02

NVD 7.7

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Record: CVE-2025-1860
CVSS 3.1: 7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-331, CWE-338
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-1860 7.7

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Record: DEBIAN-CVE-2025-1860
CVSS 3.1: 7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-1860 7.7

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Record: UBUNTU-CVE-2025-1860
CVSS 3.1: 7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

Show 4 moreShow less

OSV No score

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Record: CVE-2025-1860
Updated: 2026-11-02

OSVMGASA-2025-0279 No score

Updated perl-Data-Entropy packages fix security vulnerability

Data::Entropy for Perl uses insecure rand() function for cryptographic functions. (CVE-2025-1860)

Record: MGASA-2025-0279
Updated: 2026-11-02

OSVopenSUSE-SU-2025:0123-1 No score

Security update for perl-Data-Entropy

This update for perl-Data-Entropy fixes the following issues:

Updated to 0.8.0 (0.008):

see /usr/share/doc/packages/perl-Data-Entropy/Changes

Version 0.008; 2025-03-27:

* Use Crypt::URandom to seed the default algorithm with
  cryptographically secure random bytes instead of the builtin
  rand() function (boo#1240395, CVE-2025-1860).
* This module has been marked as deprecated.
* A security policy was added.
* Remove use of Module::Build.
* Updated maintainer information.

Record: openSUSE-SU-2025:0123-1
Updated: 2026-11-02

OSVopenSUSE-SU-2025:14960-1 No score

perl-Data-Entropy-0.8.0-1.1 on GA media

These are all security issues fixed in the perl-Data-Entropy-0.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:14960-1
Updated: 2026-11-02

Affected products

zefram data::entropy

Affected packages

Affected packages
Package	Affected	Fixed
`libdata-entropy-perl` Debian:12	before 0.007-4+deb12u1, plus listed versions 0.007-4	0.007-4+deb12u1
`libdata-entropy-perl` Debian:13	before 0.008-1	0.008-1
`libdata-entropy-perl` Debian:14	before 0.008-1	0.008-1
`libdata-entropy-perl` Debian:11	before 0.007-3.1+deb11u1, plus listed versions 0.007-3.1	0.007-3.1+deb11u1
`perl-Data-Entropy` Mageia:9	before 0.7.0-10.1.mga9	0.7.0-10.1.mga9
`libdata-entropy-perl` Ubuntu:16.04:LTS	All versions, plus listed versions 0.007-3	None known
`libdata-entropy-perl` Ubuntu:18.04:LTS	All versions, plus listed versions 0.007-3	None known
`libdata-entropy-perl` Ubuntu:20.04:LTS	All versions, plus listed versions 0.007-3	None known
`libdata-entropy-perl` Ubuntu:22.04:LTS	All versions, plus listed versions 0.007-3.1	None known
`libdata-entropy-perl` Ubuntu:24.04:LTS	All versions, plus listed versions 0.007-4	None known

Show 6 moreShow less

Affected packages
Package	Affected	Fixed
`libdata-entropy-perl` Ubuntu:25.10	All versions, plus listed versions 0.007-40.008-1	None known
`libdata-entropy-perl` Ubuntu:26.10	All versions, plus listed versions 0.008-1	None known
`libdata-entropy-perl` Ubuntu:26.04:LTS	All versions, plus listed versions 0.008-1	None known
`perl-Data-Entropy` SUSE:Package Hub 15 SP6	before 0.8.0-bp156.4.3.1	0.8.0-bp156.4.3.1
`perl-Data-Entropy` openSUSE:Leap 15.6	before 0.8.0-bp156.4.3.1	0.8.0-bp156.4.3.1
`perl-Data-Entropy` openSUSE:Tumbleweed	before 0.8.0-1.1	0.8.0-1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-1860 is a high vulnerability (CVSS 7.7) in Zefram Data::entropy, published March 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in libdata-entropy-perl 0.007-4+deb12u1.

References

Show 9 moreShow less