Fedora EPEL 9 update for perl-Data-Entropy



Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2025-1860
CWE-ID CWE-330
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Fedora
Operating systems & Components / Operating system

perl-Data-Entropy
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Use of insufficiently random values

EUVDB-ID: #VU106276

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-1860

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

Description

The vulnerability allows an attacker to bypass implemented security restrictions.

The vulnerability exists due to software uses the rand() function as the default source of entropy, which is not cryptographically secure. A remote attacker can bypass implemented security restrictions.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 9

perl-Data-Entropy: before 0.008-1.el9

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-3ea9a27f9b


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###