CVE-2026-8647
Description
A flaw was found in perl-Crypt-ScryptKDF. The random_bytes function in versions through 0.010 uses an insecure random number source when no cryptographically secure pseudorandom number generator (CSPRNG) module is available. This occurs because the function falls back to using the built-in rand() function. An attacker could potentially exploit this to predict random values, leading to weaker cryptographic operations and possible information disclosure or integrity compromise.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
If a PRNG is used for authentication and authorization, such as a session ID or a seed for generating a cryptographic key, then an attacker may be able to easily guess the ID or cryptographic key and gain access to restricted functionality.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
