CVE-2026-5088

Katalog CVE

CVSS 7.5 · High EPSS 0,58%

Kerentanan Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) pada jdeguest apache. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts. The _make_salt and _make_salt_bcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply return 16 bytes generated with Perl's built-in rand function. The rand function is unsuitable for cryptographic use. These salts are used for password hashing.

Rincian

Terbit di NVD

15 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2026/04/15/4 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/04/15/5 mailing list · advisory pihak ketiga
• https://metacpan.org/pod/Crypt::URandom product
• https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.2/view/lib/Apache2/API/Password.pod product
• https://metacpan.org/release/JDEGUEST/Apache2-API-v0.5.3/changes release notes
• https://security.metacpan.org/docs/guides/random-data-for-security.html product