Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 0.2%
exploitation probability
0.2%top 87% of all CVEs
observed exploitation
nono source reports it
In short
Crypt::ScryptKDF uses an insecure random number generator as a fallback when proper cryptographic libraries aren't installed. This can make passwords and security keys predictable, weakening protection.
Technical detail
The library falls back to Perl's built-in rand() function instead of a cryptographically secure PRNG when no dedicated CSPRNG module is available. This occurs when Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, and Bytes::Random::Secure are absent. The predictable randomness undermines key derivation security in Scrypt.
Summary generated and translated by AI from the official description.
Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available.
The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
MIK · Crypt::ScryptKDF