CVE-2024-56370 Details

A vulnerability exists in the Net::Xero Perl module, specifically in versions through 0.044, due to the use of the rand() function as the default entropy source for cryptographic operations. This approach relies on a non-cryptographically secure random number generator, which can lead to predictable outcomes. The Data::Random library, utilized by Net::Xero, explicitly states its randomness is suitable mainly for testing purposes. This vulnerability could be exploited by anyone using the affected module in a context requiring secure random data, such as generating tokens or keys for authentication or encryption.

Users can upgrade to Net::Xero version 0.045 or later, which addresses this vulnerability by using a secure source of randomness for cryptographic functions.