#1102148 libweb-api-perl: CVE-2024-57868

Package:
src:libweb-api-perl
Source:
src:libweb-api-perl
Submitter:
Salvatore Bonaccorso
Date:
2025-04-05 18:09:03 UTC
Severity:
normal
Tags:
#1102148#5
Date:
2025-04-05 18:08:15 UTC
From:
To:
Hi,

The following vulnerability was published for libweb-api-perl.

CVE-2024-57868[0]:
| Web::API 2.8 and earlier for Perl uses the rand() function as the
| default source of entropy, which is not cryptographically secure,
| for cryptographic functions.  Specifically Web::API uses the
| Data::Random library which specifically states that it is "Useful
| mostly for test programs". Data::Random uses the rand() function.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-57868
https://www.cve.org/CVERecord?id=CVE-2024-57868
[1] https://lists.security.metacpan.org/cve-announce/msg/28503730/

Regards,
Salvatore