CVE-2025-15604

{"id": "CVE-2025-15604", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2026-03-28T19:16:53.387", "references": [{"url": "https://github.com/tokuhirom/Amon/pull/135", "tags": ["Issue Tracking", "Patch"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/TOKUHIROM/Amon2-6.17/changes", "tags": ["Product"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/TOKUHIROM/Amon2-6.17/diff/TOKUHIROM/Amon2-6.16#lib/Amon2/Util.pm", "tags": ["Product"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/28/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}]}], "descriptions": [{"lang": "en", "value": "Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions.\n\nIn versions 6.06 through 6.16, the random_string function will attempt to read bytes from the /dev/urandom device, but if that is unavailable then it generates bytes by concatenating a SHA-1 hash seeded with the built-in rand() function, the PID, and the high resolution epoch time. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nBefore version 6.06, there was no fallback when /dev/urandom was not available.\n\nBefore version 6.04, the random_string function used the built-in rand() function to generate a mixed-case alphanumeric string.\n\nThis function may be used for generating session ids, generating secrets for signing or encrypting cookie session data and generating tokens used for Cross Site Request Forgery (CSRF) protection."}, {"lang": "es", "value": "Las versiones de Amon2 anteriores a la 6.17 para Perl utilizan una implementaci\u00f3n insegura de random_string para funciones de seguridad.\n\nEn las versiones 6.06 a la 6.16, la funci\u00f3n random_string intentar\u00e1 leer bytes del dispositivo /dev/urandom, pero si este no est\u00e1 disponible, entonces genera bytes concatenando un hash SHA-1 inicializado con la funci\u00f3n rand() incorporada, el PID y el tiempo de \u00e9poca de alta resoluci\u00f3n. El PID provendr\u00e1 de un peque\u00f1o conjunto de n\u00fameros, y el tiempo de \u00e9poca puede ser adivinado, si no se filtra del encabezado HTTP Date. La funci\u00f3n rand incorporada no es adecuada para uso criptogr\u00e1fico.\n\nAntes de la versi\u00f3n 6.06, no hab\u00eda un mecanismo de respaldo cuando /dev/urandom no estaba disponible.\n\nAntes de la versi\u00f3n 6.04, la funci\u00f3n random_string utilizaba la funci\u00f3n rand() incorporada para generar una cadena alfanum\u00e9rica de may\u00fasculas y min\u00fasculas.\n\nEsta funci\u00f3n puede ser utilizada para generar IDs de sesi\u00f3n, generar secretos para firmar o cifrar datos de sesi\u00f3n de cookie y generar tokens utilizados para la protecci\u00f3n contra la falsificaci\u00f3n de solicitudes entre sitios (CSRF)."}], "lastModified": "2026-04-01T15:16:23.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tokuhirom:amon2:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "0920218A-C374-46FB-A8C8-FC92ACFB73DB", "versionEndExcluding": "6.17"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}