/ 
Data-Entropy-0.009
Security Advisories (1)
CVE-2026-18536 (2026-08-01)

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string. Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by rand_bits and rand_int for every application that selected one of these sources via with_entropy_source. The _checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.

Changes for version 0.009

  • Security
    • The RandomOrg and RandomnumbersInfo sources now make requests over https. (CVE-2026-18536)
  • Documentation
    • Updated security policy to have consistent contact instructions.
    • Reformatted Changes to conform to CPAN::Changes::Spec.
    • Updated author email.
    • Updated copyright year.
  • Other
    • Updated license metadata in Makefile.PL.
    • Stopped signing the distribution, since Module::Signature is deprecated.

Documentation

SECURITY.md

Modules

Data::Entropy
entropy (randomness) management
Data::Entropy::Algorithms
basic entropy-using algorithms
Data::Entropy::RawSource::CryptCounter
counter mode of block cipher as I/O handle
Data::Entropy::RawSource::Local
read randomness from local device
Data::Entropy::RawSource::RandomOrg
download entropy from random.org
Data::Entropy::RawSource::RandomnumbersInfo
download entropy from randomnumbers.info
Data::Entropy::Source
encapsulated source of entropy

Other files