Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string.
Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by rand_bits and rand_int for every application that selected one of these sources via with_entropy_source. The _checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Rrwo Data\
cpe:2.3:a:rrwo:data\:\:entropy:*:*:*:*:*:perl:*:*
|
— |
0.010
|
References 5
https://github.com/robrwo/Data-Entropy/security/advisories/GHSA-845w-rcqw-jwvv
9b29abf9-4ab0-4765-b253-1875cd9b441e
https://metacpan.org/release/RRWO/Data-Entropy-0.008/view/lib/Data/Entropy.pm#S…
9b29abf9-4ab0-4765-b253-1875cd9b441e
https://metacpan.org/release/RRWO/Data-Entropy-0.010/changes
9b29abf9-4ab0-4765-b253-1875cd9b441e
https://security.metacpan.org/docs/guides/random-data-for-security.html
9b29abf9-4ab0-4765-b253-1875cd9b441e
http://www.openwall.com/lists/oss-security/2026/08/01/8
af854a3a-2127-422b-91ae-364da2661108