In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://datatracker.ietf.org/doc/html/rfc5849#section-3.3 cve-icon cve-icon
https://datatracker.ietf.org/doc/html/rfc5849#section-4.10 cve-icon cve-icon
https://github.com/keeth/Net-OAuth/commit/2aa25e04aadab247ae4063363fcee177161e1f42 cve-icon cve-icon
https://metacpan.org/release/KGRENNAN/Net-OAuth-0.28/source/lib/Net/OAuth/Client.pm#L260 cve-icon cve-icon cve-icon
https://metacpan.org/release/RRWO/Net-OAuth-0.29/changes cve-icon cve-icon cve-icon
https://metacpan.org/release/RRWO/Net-OAuth-0.29/diff/KGRENNAN/Net-OAuth-0.28#lib/Net/OAuth/Client.pm cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-22376 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-22376 cve-icon
https://www.vulnarium.com/blogpost-2025-01-05 cve-icon cve-icon
History

Tue, 21 Jan 2025 18:15:00 +0000

Type Values Removed Values Added
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jan 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Sat, 04 Jan 2025 01:45:00 +0000

Type Values Removed Values Added
Title perl-Net-OAuth: Default nonce for Net::OAuth package for perl is not cryptographically strong
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 03 Jan 2025 23:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 03 Jan 2025 21:30:00 +0000

Type Values Removed Values Added
Description In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.
Weaknesses CWE-338
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-01-21T17:49:18.077Z

Reserved: 2025-01-03T00:00:00

Link: CVE-2025-22376

cve-icon Vulnrichment

Updated: 2025-01-03T22:55:40.997Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-01-03T22:15:07.917

Modified: 2025-01-21T18:15:15.473

Link: CVE-2025-22376

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-01-03T00:00:00Z

Links: CVE-2025-22376 - Bugzilla