CVE-2024-58041 - Vulnerability Analysis

Overview

Smolder <= 1.51 for Perl contains weak cryptography caused by use of insecure rand() function in Data::Random library for cryptographic functions, letting attackers potentially predict cryptographic values, exploit requires no special privileges.

Severity & Score

Impact

Attackers can predict cryptographic values, potentially compromising security mechanisms relying on randomness.

Mitigation

Update to the latest version that replaces rand() with a cryptographically secure random number generator.

References

• https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L5
• https://perldoc.perl.org/functions/rand
• https://security.metacpan.org/docs/guides/random-data-for-security.html
• https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537
• https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L221

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner