CVE-2025-1860
Published: 28 March 2025
Summary
CVE-2025-1860 is a high-severity Insufficient Entropy (CWE-331) vulnerability in Metacpan (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, ranked at the 24.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-12 (Cryptographic Key Establishment and Management) and SC-13 (Cryptographic Protection).
Deeper analysis
CVE-2025-1860 is a vulnerability in the Data::Entropy Perl module, affecting versions 0.007 and earlier. The module relies on Perl's rand() function as the default entropy source for cryptographic functions, but rand() is not cryptographically secure, leading to predictable outputs that undermine security. This issue is classified under CWE-331 (Insufficient Entropy) and CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator), with a CVSS v3.1 base score of 7.7.
The vulnerability can be exploited by a local attacker with low attack complexity, requiring no privileges (PR:N), no user interaction (UI:N), and local access (AV:L), resulting in unchanged scope (S:U). Exploitation enables high impacts on confidentiality (C:H) and integrity (I:H) with no availability impact (A:N), potentially allowing attackers to predict or forge cryptographic values such as keys, nonces, or signatures used by applications depending on this module.
Advisories provide guidance on mitigation, including a Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2025/03/msg00026.html. Additional technical details are available in the affected source code at https://metacpan.org/release/ZEFRAM/Data-Entropy-0.007/source/lib/Data/Entropy.pm#L80 and Perl's rand() documentation at https://perldoc.perl.org/functions/rand.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8533
Vulnerability details
Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring identification, assessment, and timely remediation of the vulnerable Data::Entropy module using weak rand() for entropy.
Requires FIPS-validated cryptographic mechanisms that use secure entropy sources, preventing use of cryptographically weak PRNGs like Perl's rand() in cryptographic functions.
Mandates NIST-approved key establishment and management processes with sufficient entropy, mitigating predictable keys, nonces, or signatures from the insufficient entropy vulnerability.