UBUNTU-CVE-2024-56830: Medium severity ubuntu/libnet-easytcp-perl vulnerability
Published Jan 2, 2025
·Updated
The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand() if no strong randomization module is present.
Affected Software
5 affected components
ubuntu/libnet-easytcp-perl*
ubuntu/libnet-easytcp-perl*
ubuntu/libnet-easytcp-perl*
ubuntu/libnet-easytcp-perl*
ubuntu/libnet-easytcp-perl*
Event History
Jan 2, 2025
CVE Published
via OSV·05:15 AM
Data Sourced
via OSV·05:15 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
When is a deployment affected by this issue?
The issue applies to Net::EasyTCP versions 0.15 through 0.26 when no strong randomization module is present, causing the package to use Perl's builtin rand().
2
What would an attacker need to exploit this weakness?
An attacker would need to exploit predictability or weakness in values generated through Perl's builtin rand() in an affected deployment. The available data does not identify the specific generated values or application workflow involved.
3
What can be done if an update is not immediately available?
Ensure that a strong randomization module is present so Net::EasyTCP does not fall back to Perl's builtin rand().