Skip to content
OpenAdvisories
Critical · 9.1 CVE-2025-15618 EUVD-2025-209143GHSA-7rq2-v6rc-96jw

Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key

Published Mar 31, 2026 · Updated Mar 31, 2026 · Assigned by CPANSec

Description

Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key.

Business::OnlinePayment::StoredTransaction generates a secret key by using a MD5 hash of a single call to the built-in rand function, which is unsuitable for cryptographic use.

This key is intended for encrypting credit card transaction data.

Affected products

VendorProductAffectedFixed
MOCK Business::OnlinePayment::StoredTransaction ≤ 0.01 —

References