CVE-2026-18536 : 상세 정보

CVE-2026-18536

2026-08-01
10h35 +00:00
A02-Cryptographic FailuresA08-Soft and Data Integrity Fail
2026-08-03
19h55 +00:00
CVE.org
NVD
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
알림 관리

CVE 설명

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string. Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by rand_bits and rand_int for every application that selected one of these sources via with_entropy_source. The _checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.

CVE 정보

관련 약점

CWE-ID 약점 이름 출처
CWE-319 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-353 Missing Support for Integrity Check
The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

참고 자료

CVE Find에 제시된 정보는 엄선된 여러 참고 소스에서 가져옵니다. CVE 데이터는 MITRE Corporation과 국가 취약점 데이터베이스(NVD)에서 제공됩니다. KEV 카탈로그는 CISA에서 가져오며, EPSS 점수는 FIRST.org에서 제공됩니다. CWE 및 CAPEC 데이터는 MITRE Corporation에서 관리하며, CPE 정보는 NVD에서 제공됩니다.