BSD Portsp5-Crypt-CBC -- Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Lib-Crypt-CBC project reports: Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.
Affected versions
- p5-Crypt-CBC < 3.07
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/p5-Crypt-CBC | 3.04 | vulnerable since 2025-07-29 | |
| OpenBSD | security/p5-Crypt-CBC | 3.07 | out of range, by version | |
| NetBSD | security/p5-Crypt-CBC | 3.07nb1 | not listed | |
| MidnightBSD | security/p5-Crypt-CBC | 3.07 | out of range, by version | |
| FreeBSD | security/p5-Crypt-CBC | 3.07 | fixed |