CVE-2026-5082 Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id

Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id. The generatesessionid function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes using SHA-1 hash seeded with the built-in rand...

CVE-2026-5082

The Amon2::Plugin::Web::CSRFDefender Perl module, versions 7.00 through 7.03 , contains a vulnerability where the generate_session_id function produces insecure session IDs . The root cause is that if the /dev/urandom device is unavailable, the system falls back to generating bytes using a SHA-1 ...

CVE-2026-5087 PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely. PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails for example, on systems without the device, such as Windows, then it...

EUVD-2025-209114

Amon2 versions before 6.17 for Perl use an insecure randomstring implementation for security functions. In versions 6.06 through 6.16, the randomstring function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes by concatenating a SHA-1 has...

CVE-2025-15604 Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions

Amon2 versions before 6.17 for Perl use an insecure randomstring implementation for security functions. In versions 6.06 through 6.16, the randomstring function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes by concatenating a SHA-1 has...

PT-2026-28276

Name of the Vulnerable Software and Affected Versions Amon2 versions prior to 6.17 Description Amon2 for Perl utilizes an insecure random string implementation in its security functions. Versions 6.06 through 6.16 attempt to use /dev/urandom, but fall back to a SHA-1 hash seeded with the built-in...

CVE-2025-2814 Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions

Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to...

EulerOS Virtualization 2.11.1 : c-ares (EulerOS-SA-2023-3049)

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will...

GSD-2022-1002387 gcc-plugins: latent_entropy: use /dev/urandom

gcc-plugins: latententropy: use /dev/urandom This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.276 by commit...

GSD-2022-1002158 gcc-plugins: latent_entropy: use /dev/urandom

gcc-plugins: latententropy: use /dev/urandom This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.190 by commit...

GSD-2022-1001951 gcc-plugins: latent_entropy: use /dev/urandom

gcc-plugins: latententropy: use /dev/urandom This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.112 by commit...

GSD-2022-1001647 gcc-plugins: latent_entropy: use /dev/urandom

gcc-plugins: latententropy: use /dev/urandom This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.35 by commit...

GSD-2022-1000963 gcc-plugins: latent_entropy: use /dev/urandom

gcc-plugins: latententropy: use /dev/urandom This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.4 by commit...

PT-2022-30736

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.311 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-29236

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.4 Description The issue concerns the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. Recommendations For versions prior to v5.17.4,...

PT-2022-30567

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.239 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.9 and fixe...

PT-2022-30431

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.190 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-30660

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.276 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-29920

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.35 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-30224

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.112 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.9 and fixe...