High severity7.7NVD Advisory· Published Mar 28, 2025· Updated Apr 15, 2026

CVE-2025-1860

Description

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Andrewalker/Data Entropyinferred2 versions
<=0.007+ 1 more
- (no CPE)range: <=0.007
- (no CPE)range: <=0.007
osv-coords3 versions
pkg:rpm/opensuse/perl-Data-Entropy&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/perl-Data-Entropy&distro=openSUSE%20Tumbleweed pkg:rpm/suse/perl-Data-Entropy&distro=SUSE%20Package%20Hub%2015%20SP6
< 0.8.0-bp156.4.3.1+ 2 more
- (no CPE)range: < 0.8.0-bp156.4.3.1
- (no CPE)range: < 0.8.0-1.1
- (no CPE)range: < 0.8.0-bp156.4.3.1

Patches

Vulnerability mechanics

References

lists.debian.org/debian-lts-announce/2025/03/msg00026.htmlnvd
metacpan.org/release/ZEFRAM/Data-Entropy-0.007/source/lib/Data/Entropy.pmnvd
perldoc.perl.org/functions/randnvd

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000