CVE-2024-58036 Details
Description
Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Dropbox::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
A vulnerability exists in Net::Dropbox::API versions through 1.9 for Perl, where the rand() function is used as the default source of entropy for cryptographic functions. This approach is not cryptographically secure, as the rand() function can be predicted and is limited to a 32-bit seed. The library Data::Random, which is utilized by Net::Dropbox::API, explicitly states its randomness is suitable only for testing purposes. This vulnerability could lead to the generation of predictable cryptographic tokens or keys, undermining the security of applications that rely on this module for Dropbox API interactions.
Users can upgrade to a version of Net::Dropbox::API later than 1.9, where this vulnerability has been addressed. Additionally, when using this module, it is recommended to manually generate cryptographically secure random data using Perl's Crypt::URandom or Crypt::SysRandom modules, and then pass that data as needed, such as for OAuth nonces or other security-sensitive tokens.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537 | CPANSec | Product |
| https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L11 | CPANSec | Product |
| https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L385 | CPANSec | Product |
| https://perldoc.perl.org/functions/rand | CPANSec | Product |
| https://security.metacpan.org/docs/guides/random-data-for-security.html | CPANSec | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | [email protected] |
| CWE-331 | Insufficient Entropy | CPANSec |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| norbu09 net::dropbox::api | <= 1.9 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Sep 29, 2025 | Modified Analysis | [email protected] |
| Sep 5, 2025 | CVE Modified | CPANSec |
| Apr 10, 2025 | Initial Analysis | [email protected] |
| Apr 7, 2025 | CVE Modified | CISA-ADP |
| Apr 5, 2025 | New CVE Received | CPANSec |