A critical vulnerability in Data::Entropy allows unauthenticated on-path attackers to compromise the integrity of generated random data, potentially leading to predictable cryptographic outputs.

The library retrieves entropy sources over plain HTTP and lacks a robust integrity check, permitting an attacker to perform a machine-in-the-middle attack. Any unauthenticated attacker positioned on the network path can intercept the traffic and substitute the returned entropy bytes, effectively controlling the output of functions that rely on these sources.

Successful exploitation compromises the security of any system relying on this library for sensitive operations, such as generating encryption keys, authentication tokens, or session identifiers. Given the CVSS score of 7.5, this high-severity flaw enables an attacker to weaken or bypass cryptographic protections, leading to potential unauthorized access or data exposure. The ability for an attacker to influence randomness makes downstream security controls unreliable and potentially trivial to break.

Immediate Action: Update the Data::Entropy Perl module to version 0.010 or later immediately to resolve the insecure transmission and integrity issues.

Proactive Monitoring: Review application logs and network traffic for unexpected outbound HTTP connections to entropy providers or anomalies in the generation of random values.

Compensating Controls: Implement network-level protections such as enforcing encrypted tunnels or VPNs for all traffic, although these are secondary to applying the vendor patch.

Public Exploit Available: No (exploit_available: unknown)

The reliance on cleartext protocols for security-sensitive entropy generation represents a fundamental design flaw that must be addressed immediately. Organizations using Data::Entropy should prioritize updating to version 0.010 to restore the integrity of their cryptographic operations. Failure to remediate this vulnerability leaves applications susceptible to sophisticated interception attacks that can undermine the entire security posture of the affected services.