UBUNTU-CVE-2024-58036
- Source
- https://ubuntu.com/security/CVE-2024-58036
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-58036.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2024-58036
- Upstream
- Published
- 2025-04-05T16:15:00Z
- Modified
- 2025-07-14T07:02:25.759821Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Dropbox::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
- References
-
- https://ubuntu.com/security/CVE-2024-58036
- https://www.cve.org/CVERecord?id=CVE-2024-58036
- https://lists.security.metacpan.org/cve-announce/msg/28504518/
- https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537
- https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L11
- https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L385
- https://perldoc.perl.org/functions/rand
- https://security.metacpan.org/docs/guides/random-data-for-security.html
Affected packages
Ubuntu:Pro:16.04:LTS / libnet-dropbox-api-perl
Package
- Name
- libnet-dropbox-api-perl
- Purl
- pkg:deb/ubuntu/libnet-dropbox-api-perl@1.9-1?arch=source&distro=esm-apps/xenial
Ubuntu:Pro:18.04:LTS / libnet-dropbox-api-perl
Package
- Name
- libnet-dropbox-api-perl
- Purl
- pkg:deb/ubuntu/libnet-dropbox-api-perl@1.9-1?arch=source&distro=esm-apps/bionic
Ubuntu:Pro:20.04:LTS / libnet-dropbox-api-perl
Package
- Name
- libnet-dropbox-api-perl
- Purl
- pkg:deb/ubuntu/libnet-dropbox-api-perl@1.9-1?arch=source&distro=esm-apps/focal
Ubuntu:22.04:LTS / libnet-dropbox-api-perl
Package
- Name
- libnet-dropbox-api-perl
- Purl
- pkg:deb/ubuntu/libnet-dropbox-api-perl@1.9-1.1?arch=source&distro=jammy
Ubuntu:24.04:LTS / libnet-dropbox-api-perl
Package
- Name
- libnet-dropbox-api-perl
- Purl
- pkg:deb/ubuntu/libnet-dropbox-api-perl@1.9-2?arch=source&distro=noble