CVE-2025-27551: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-27551 affects DBIx::Class::EncodedColumn up to version 0.00032, discovered and disclosed on March 26, 2025. The vulnerability exists in the password hashing mechanism where the software uses the rand() function, which is not cryptographically secure, for generating salt values. This issue specifically affects the program file lib/DBIx/Class/EncodedColumn/Digest.pm (NVD).

The vulnerability stems from the use of Perl's built-in rand() function for generating salt values in password hashing operations. The rand() function is seeded by only 32-bits (4 bytes), making its output predictable and unsuitable for cryptographic purposes. The CVSS v3.1 base score is 4.0 (MEDIUM) with a vector string of CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating local access is required and the impact is primarily on confidentiality (NVD, CPAN Security).

The use of a weak random number generator for salt generation could potentially make password hashes more predictable, thereby weakening the overall security of the password storage system. This could lead to increased vulnerability to password cracking attempts (CPAN Security).

The issue has been fixed in version 0.00032 of DBIx::Class::EncodedColumn, released on March 25, 2025. The fix replaces the rand() function with Crypt::URandom and Crypt::URandom::Token for secure salt generation. Users are advised to upgrade to version 0.00032 or later (Changes, Debian Changes).