USN-8985-1: libnet-easytcp-perl vulnerability
It was discovered that Net::EasyTCP used the built-in Perl rand() function to generate encryption keys when no strong randomization module was present. An attacker could possibly use this issue to predict the keys and obtain sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libnet-easytcp-perlto a version that resolves this vulnerability.Fixed in 0.26-3ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/libnet-easytcp-perlto a version that resolves this vulnerability.Fixed in 0.26-4ubuntu0.18.04.1~esm1 - Upgrade
Upgrade
ubuntu/libnet-easytcp-perlto a version that resolves this vulnerability.Fixed in 0.26-4ubuntu0.20.04.1~esm1 - Upgrade
Upgrade
ubuntu/libnet-easytcp-perlto a version that resolves this vulnerability.Fixed in 0.26-4ubuntu0.22.04.1~esm1 - Upgrade
Upgrade
ubuntu/libnet-easytcp-perlto a version that resolves this vulnerability.Fixed in 0.26-6+deb11u1build0.24.04.1
Event History
Frequently Asked Questions
Which deployments are exposed to predictable encryption keys?
Deployments are affected when Net::EasyTCP generates encryption keys without a strong randomization module being present, causing it to fall back to Perl's built-in rand() function.
What would an attacker need to do to exploit this issue?
An attacker would need to predict encryption keys generated through the rand() fallback. Successful prediction could allow the attacker to obtain sensitive information protected using those keys.