CVE-2024-58041

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-58041
Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions. Smolder 1.51 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Smolder::DB::Developer uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537 Issue Tracking
https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L221 Issue Tracking
https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L5 Issue Tracking
https://perldoc.perl.org/functions/rand Third Party Advisory
https://security.metacpan.org/docs/guides/random-data-for-security.html Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wonko:smolder:*:*:*:*:*:perl:*:*
History

04 Mar 2026, 02:22

Type Values Removed Values Added
References () https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537 - () https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537 - Issue Tracking
References () https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L221 - () https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L221 - Issue Tracking
References () https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L5 - () https://metacpan.org/release/WONKO/Smolder-1.51/source/lib/Smolder/DB/Developer.pm#L5 - Issue Tracking
References () https://perldoc.perl.org/functions/rand - () https://perldoc.perl.org/functions/rand - Third Party Advisory
References () https://security.metacpan.org/docs/guides/random-data-for-security.html - () https://security.metacpan.org/docs/guides/random-data-for-security.html - Third Party Advisory
First Time Wonko
Wonko smolder
CPE cpe:2.3:a:wonko:smolder:*:*:*:*:*:perl:*:*

24 Feb 2026, 18:29

Type Values Removed Values Added
Summary
  • (es) Las versiones de Smolder hasta la 1.51 para Perl utilizan la función rand() insegura para funciones criptográficas. Smolder 1.51 y anteriores para Perl utilizan la función rand() como fuente de entropía predeterminada, que no es criptográficamente segura, para funciones criptográficas. Específicamente, Smolder::DB::Developer utiliza la biblioteca Data::Random, que específicamente indica que es 'Útil principalmente para programas de prueba'. Data::Random utiliza la función rand().
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1

24 Feb 2026, 00:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-24 00:16

Updated : 2026-03-04 02:22

NVD link : CVE-2024-58041

Mitre link : CVE-2024-58041

CVE.ORG link : CVE-2024-58041

JSON object : View

Products Affected

wonko

  • smolder
CWE
CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)