CVE-2024-58041
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2Description
Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions. Smolder 1.51 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Smolder::DB::Developer uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
Analysis
Insecure random number generation in Smolder 1.51 Perl testing framework. Uses rand() for cryptographic operations instead of a CSPRNG, enabling prediction of security tokens.
Technical Context
CWE-338 use of cryptographically weak PRNG. rand() output is predictable — any tokens, session IDs, or nonces generated with it can be predicted.
Affected Products
['Smolder <= 1.51']
Remediation
Replace rand() with a CSPRNG (e.g., Crypt::URandom).
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today