CVE-2024-58040 Details
Description
Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption.
A vulnerability exists in the Perl module Crypt::RandomEncryption, version 0.01, due to the use of the insecure rand() function for encryption. The rand() function is not cryptographically secure and can lead to predictable random values, making it unsuitable for security-sensitive applications such as encryption.
Users are advised to switch to a more secure random number generator for encryption purposes. CPAN offers several modules that provide cryptographically secure random data, such as Crypt::URandom, Crypt::PRNG, and Crypt::OpenSSL::Random.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 30, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/QWER/Crypt-RandomEncryption-0.01/source/lib/Crypt/RandomEncryption.pm#L33 | CPANSec | Broken LinkProduct |
| https://perldoc.perl.org/functions/rand | CPANSec | Third Party Advisory |
| https://security.metacpan.org/docs/guides/random-data-for-security.html | CPANSec | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-331 | Insufficient Entropy | CPANSec |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| qwer crypt::randomencryption | 0.01 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 9, 2026 | Initial Analysis | [email protected] |
| Sep 30, 2025 | CVE Modified | CISA-ADP |
| Sep 30, 2025 | New CVE Received | CPANSec |