{"id":"CVE-2026-13082","state":"PUBLISHED","title":"GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets","description":"GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.\n\nThe random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.\n\nThe built-in rand function is unsuitable for security applications because it is predictable and reversible.","publishedAt":"2026-07-17T12:54:07.177Z","updatedAt":"2026-07-17T17:29:23.536Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"CISA-ADP"},"assigner":"CPANSec","products":["BURAK GD::SecurityImage"],"affected":[{"vendor":"BURAK","product":"GD::SecurityImage","packageName":"GD-SecurityImage","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.75","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["lib/GD/SecurityImage.pm"],"programRoutines":[{"name":"GD::SecurityImage::random"},{"name":"GD::SecurityImage::random_angle"},{"name":"GD::SecurityImage::particle"}],"repo":"https://github.com/burak/CPAN-GD-SecurityImage"}],"references":["https://www.cve.org/CVERecord?id=CVE-2025-40916","https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch"],"weaknesses":["CWE-338","CWE-804"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/13xxx/CVE-2026-13082.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-13082","state":"PUBLISHED","datePublished":"2026-07-17T12:54:07.177Z","dateUpdated":"2026-07-17T17:29:23.536Z","assignerShortName":"CPANSec","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateReserved":"2026-06-23T18:17:08.243Z"},"containers":{"cna":{"title":"GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets","descriptions":[{"lang":"en","value":"GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.\n\nThe random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.\n\nThe built-in rand function is unsuitable for security applications because it is predictable and reversible."}],"affected":[{"vendor":"BURAK","product":"GD::SecurityImage","packageName":"GD-SecurityImage","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.75","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["lib/GD/SecurityImage.pm"],"programRoutines":[{"name":"GD::SecurityImage::random"},{"name":"GD::SecurityImage::random_angle"},{"name":"GD::SecurityImage::particle"}],"repo":"https://github.com/burak/CPAN-GD-SecurityImage"}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40916","tags":["related"]},{"url":"https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch","tags":["patch"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-338","description":"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-804","description":"CWE-804 Guessable CAPTCHA","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CPANSec","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateUpdated":"2026-07-17T12:54:07.177Z"},"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2018-12-24T00:00:00.000Z","value":"Version 1.75 released."},{"lang":"en","time":"2026-03-10T00:00:00.000Z","value":"The git repository was archived."}],"workarounds":[{"lang":"en","value":"GD::SecurityImage has not been updated since 2018, the module is flagged as ADOPTME on CPAN, and the git repository is archived as read-only, which prevents issues and pull requests from being created.\n\nUsers are advised to find an alternative solution.\n\nFor users who are unable to migrate to an alternative, install Crypt::URandom::MonkeyPatch (which will override the built-in rand with a wrapper around Crypt::URandom) and apply the patch."}],"x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-17T17:29:10.397745Z","id":"CVE-2026-13082","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-17T17:29:23.536Z"}}]}}}