CVE-2025-22376

In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.

References

Affected packages

Git / github.com/keeth/Net-OAuth

Affected ranges

Type

GIT

Repo

https://github.com/keeth/Net-OAuth

Events

Introduced

Fixed

18f01ea2686b18560684957b402fd481f8db1a2b

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.29"
        }
    ]
}

Type: GIT
Repo: https://github.com/keeth/net-oauth
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

2aa25e04aadab247ae4063363fcee177161e1f42

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-22376.json"