Summary
It was discovered that Net::EasyTCP used the built-in Perl rand() function
to generate encryption keys when no strong randomization module was
present. An attacker could possibly use this issue to predict the keys and
obtain sensitive information.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | libnet-easytcp-perl | 0.26-6+deb11u1build0.24.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libnet-easytcp-perl | 0.26-3ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libnet-easytcp-perl | 0.26-4ubuntu0.18.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libnet-easytcp-perl | 0.26-4ubuntu0.20.04.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libnet-easytcp-perl | 0.26-4ubuntu0.22.04.1~esm1 |
Vulnerabilities 1
-
Medium 5.4
The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand() if no strong randomization module is pre…
References
-
report
https://ubuntu.com/security/CVE-2024-56830