Bug 2481746 (CVE-2026-8647)

Summary: CVE-2026-8647 perl-Crypt-ScryptKDF: Crypt::ScryptKDF for Perl uses insecure random number source when no CSPRNG module is available
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-Crypt-ScryptKDF. The `random_bytes` function in versions through 0.010 uses an insecure random number source when no cryptographically secure pseudorandom number generator (CSPRNG) module is available. This occurs because the function falls back to using the built-in `rand()` function. An attacker could potentially exploit this to predict random values, leading to weaker cryptographic operations and possible information disclosure or integrity compromise.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2484583, 2484584    
Bug Blocks:    

Description OSIDB Bzimport 2026-05-27 00:01:20 UTC 
Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available.

The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL::Random, Net::SSLeay, Crypt::Random, or Bytes::Random::Secure were available.