{"id":"CVE-2025-1860","aliases":["DEBIAN-CVE-2025-1860","DLA-4100-1","EUVD-2025-8533","GHSA-g3hm-j3wc-jcg9","MGASA-2025-0279","UBUNTU-CVE-2025-1860","openSUSE-SU-2025:0123-1","openSUSE-SU-2025:14960-1"],"status":"published","title":"Data::Entropy for Perl uses insecure rand() function for cryptographic functions","description":"Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00191,"percentile":0.08777,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-331","CWE-338"],"published":"2025-03-28T00:56:08Z","modified":"2026-10-17T12:56:48Z","fixes":[{"ecosystem":"Debian:12","package":"libdata-entropy-perl","fixed_in":["0.007-4+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libdata-entropy-perl","fixed_in":["0.008-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libdata-entropy-perl","fixed_in":["0.008-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libdata-entropy-perl","fixed_in":["0.007-3.1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-Data-Entropy","fixed_in":["0.7.0-10.1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP6","package":"perl-Data-Entropy","fixed_in":["0.8.0-bp156.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"perl-Data-Entropy","fixed_in":["0.8.0-bp156.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Data-Entropy","fixed_in":["0.8.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.007-4+deb12u1"}]}],"versions":["0.007-4"]},{"source":"osv","ecosystem":"Debian:13","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.008-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.008-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.007-3.1+deb11u1"}]}],"versions":["0.007-3.1"]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Data-Entropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-10.1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.007-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.007-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.007-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.007-3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.007-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.007-4","0.008-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.008-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdata-entropy-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.008-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"perl-Data-Entropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-bp156.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"perl-Data-Entropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-bp156.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Data-Entropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-1.1"}]}]}],"products":[{"vendor":"zefram","product":"data::entropy"}],"references":[{"url":"https://perldoc.perl.org/functions/rand","tags":["web","report"]},{"url":"https://metacpan.org/release/ZEFRAM/Data-Entropy-0.007/source/lib/Data/Entropy.pm#L80","tags":["web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00026.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1860"},{"url":"https://github.com/advisories/GHSA-g3hm-j3wc-jcg9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-1860","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0279.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34212","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/77JMVPALVOSZWBL54FOO42D3RMLW2DLP/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-1860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-1860","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DEV777CDY3ONNFKV6ZABSLHPDKVBS3AA/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240395","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1860","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DHNSZNIJ4MT3VLBZKDACZVYLXA7WV2I5/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-1860","title":"Data::Entropy for Perl uses insecure rand() function for cryptographic functions","description":"Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.","status":"published","published":"2025-03-28T00:56:08.647Z","modified":"2025-09-05T13:20:15.508Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-338","CWE-331"],"updated_at":"2026-11-02T14:32:49.503917Z"}],"euvd":[{"id":"EUVD-2025-8533","description":"Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.","status":"published","published":"2025-03-28T00:56:08Z","modified":"2025-09-05T13:20:15Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:31:46.9428Z"}],"ghsa":[{"id":"GHSA-g3hm-j3wc-jcg9","title":"Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy...","description":"Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.","status":"published","published":"2025-03-28T03:30:24Z","modified":"2025-09-05T15:31:07Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-331","CWE-338"],"updated_at":"2026-11-02T15:03:29.490192Z"}],"nvd":[{"id":"CVE-2025-1860","description":"Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.","status":"published","published":"2025-03-28T01:15:16.063Z","modified":"2026-06-17T08:39:55.093Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-331","CWE-338"],"updated_at":"2026-11-02T14:10:56.494516Z"}],"osv":[{"id":"DEBIAN-CVE-2025-1860","description":"Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.","status":"published","published":"2025-03-28T01:15:16.063Z","modified":"2026-09-01T20:05:41.700758674Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"UBUNTU-CVE-2025-1860","description":"Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.","status":"published","published":"2025-03-28T01:15:00Z","modified":"2026-10-17T12:56:48.571810037Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"CVE-2025-1860","description":"Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.","status":"published","published":"2025-03-28T01:15:16Z","modified":"2026-04-16T04:34:16.910044536Z","updated_at":"2026-11-02T15:44:46.665428Z"},{"id":"DLA-4100-1","title":"libdata-entropy-perl - security update","status":"published","published":"2025-03-31T00:00:00Z","modified":"2026-03-09T01:19:37.172615Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0279","title":"Updated perl-Data-Entropy packages fix security vulnerability","description":"Data::Entropy for Perl uses insecure rand() function for cryptographic\nfunctions. (CVE-2025-1860)\n","status":"published","published":"2025-11-12T21:29:34Z","modified":"2026-04-16T04:43:01.600019316Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:0123-1","title":"Security update for perl-Data-Entropy","description":"This update for perl-Data-Entropy fixes the following issues:\n\nUpdated to 0.8.0 (0.008):\n\n   see /usr/share/doc/packages/perl-Data-Entropy/Changes\n\nVersion 0.008; 2025-03-27:\n\n    * Use Crypt::URandom to seed the default algorithm with\n      cryptographically secure random bytes instead of the builtin\n      rand() function (boo#1240395, CVE-2025-1860).\n    * This module has been marked as deprecated.\n    * A security policy was added.\n    * Remove use of Module::Build.\n    * Updated maintainer information.\n","status":"published","published":"2025-04-16T14:02:07Z","modified":"2026-02-04T02:38:46.257954Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14960-1","title":"perl-Data-Entropy-0.8.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Data-Entropy-0.8.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-02T00:00:00Z","modified":"2026-02-04T03:02:36.487915Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}