Description
SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD_PATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libnet-ssleay-perl | 1.25-1.1 | — |
| Debian 13 | libnet-ssleay-perl | 1.25-1.1 | — |
| Debian 12 | libnet-ssleay-perl | 1.25-1.1 | — |
References
- USN-113-1 vendor-advisory
- 18639 third-party-advisory
- MDKSA-2006:023 vendor-advisory
- 13471 vdb-entry