{"id":"CVE-2025-22376","aliases":["DEBIAN-CVE-2025-22376","EUVD-2025-2763","GHSA-w287-9q69-3hx9","MGASA-2025-0062","UBUNTU-CVE-2025-22376","openSUSE-SU-2026:12065-1"],"status":"published","title":"In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32...","description":"In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00608,"percentile":0.49452,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-338"],"published":"2025-01-03T00:00:00Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Debian:13","package":"libnet-oauth-perl","fixed_in":["0.30-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnet-oauth-perl","fixed_in":["0.30-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-Net-OAuth","fixed_in":["0.300.0-1.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-Crypt-URandom","fixed_in":["0.370.0-1.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-Module-Build","fixed_in":["0.423.400-1.mga9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Net-OAuth","fixed_in":["0.330.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libnet-oauth-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28-4","0.30-1","0.31-1","0.31-2","0.32-1","0.33-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libnet-oauth-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libnet-oauth-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Net-OAuth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.300.0-1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Crypt-URandom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.370.0-1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Module-Build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.423.400-1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libnet-oauth-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libnet-oauth-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnet-oauth-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnet-oauth-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnet-oauth-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28-4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Net-OAuth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.330.0-2.1"}]}]}],"references":[{"url":"https://metacpan.org/release/RRWO/Net-OAuth-0.29/changes","tags":["web","report"]},{"url":"https://metacpan.org/release/KGRENNAN/Net-OAuth-0.28/source/lib/Net/OAuth/Client.pm#L260","tags":["web","report"]},{"url":"https://metacpan.org/release/RRWO/Net-OAuth-0.29/diff/KGRENNAN/Net-OAuth-0.28#lib/Net/OAuth/Client.pm","tags":["web"]},{"url":"https://www.vulnarium.com/blogpost-2025-01-05","tags":["article"]},{"url":"https://github.com/keeth/Net-OAuth/commit/2aa25e04aadab247ae4063363fcee177161e1f42","tags":["fix"]},{"url":"https://datatracker.ietf.org/doc/html/rfc5849#section-4.10","tags":["web"]},{"url":"https://datatracker.ietf.org/doc/html/rfc5849#section-3.3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22376","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w287-9q69-3hx9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22376.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-22376","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0062.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33923","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLAEBHWU2NBVEDHXVVKYY4Y2XLNJX2VX/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-22376","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22376","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22376","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-22376","description":"In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.","status":"published","published":"2025-01-03T00:00:00Z","modified":"2025-01-21T17:49:18.077Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-338","CWE-338"],"updated_at":"2026-11-02T14:32:29.286772Z"}],"euvd":[{"id":"EUVD-2025-2763","description":"In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.","status":"published","published":"2025-01-03T00:00:00Z","modified":"2025-01-21T17:49:18Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:15.779798Z"}],"ghsa":[{"id":"GHSA-w287-9q69-3hx9","title":"In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32...","description":"In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.","status":"published","published":"2025-01-04T00:33:40Z","modified":"2025-01-21T18:32:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:59:37.435968Z"}],"nvd":[{"id":"CVE-2025-22376","description":"In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.","status":"published","published":"2025-01-03T22:15:07.917Z","modified":"2026-06-17T08:46:53.81Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:10:48.373347Z"}],"osv":[{"id":"CVE-2025-22376","description":"In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.","status":"published","published":"2025-01-03T00:00:00Z","modified":"2026-10-28T02:30:45.106206508Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:44:47.009967Z"},{"id":"DEBIAN-CVE-2025-22376","description":"In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.","status":"published","published":"2025-01-03T22:15:07.917Z","modified":"2026-09-01T20:05:44.205326808Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:45.524682Z"},{"id":"UBUNTU-CVE-2025-22376","description":"In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.","status":"published","published":"2025-01-03T22:15:00Z","modified":"2025-10-24T05:18:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"MGASA-2025-0062","title":"Updated perl-Net-OAuth, perl-Crypt-URandom \u0026 perl-Module-Build packages fix security vulnerability","description":"In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl,\nthe default nonce is a 32-bit integer generated from the built-in rand()\nfunction, which is not cryptographically strong. (CVE-2025-22376)\n","status":"published","published":"2025-02-13T19:09:12Z","modified":"2026-04-16T04:43:53.497484885Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:12065-1","title":"perl-Net-OAuth-0.330.0-2.1 on GA media","description":"These are all security issues fixed in the perl-Net-OAuth-0.330.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-07T17:23:11.337979243Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}