DEBIAN-CVE-2026-18536

Bulletin has no description...

CVE-2026-18536

Data::Entropy for Perl (Data::Entropy, prior to version 0.010) reads remote entropy sources over plain HTTP via Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo. The integrity check for RandomOrg trivially matches any non-empty string, enabling on-path attackers...

CVE-2026-18536

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...