CVE-2026-13082

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13082", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-06-23T18:17:08.243Z", "datePublished": "2026-07-17T12:54:07.177Z", "dateUpdated": "2026-07-17T17:29:23.536Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "GD-SecurityImage", "product": "GD::SecurityImage", "programFiles": ["lib/GD/SecurityImage.pm"], "programRoutines": [{"name": "GD::SecurityImage::random"}, {"name": "GD::SecurityImage::random_angle"}, {"name": "GD::SecurityImage::particle"}], "repo": "https://github.com/burak/CPAN-GD-SecurityImage", "vendor": "BURAK", "versions": [{"lessThanOrEqual": "1.75", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.\n\nThe random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.\n\nThe built-in rand function is unsuitable for security applications because it is predictable and reversible."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-804", "description": "CWE-804 Guessable CAPTCHA", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-17T12:54:07.177Z"}, "references": [{"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2025-40916"}, {"tags": ["patch"], "url": "https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2018-12-24T00:00:00.000Z", "value": "Version 1.75 released."}, {"lang": "en", "time": "2026-03-10T00:00:00.000Z", "value": "The git repository was archived."}], "title": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets", "workarounds": [{"lang": "en", "value": "GD::SecurityImage has not been updated since 2018, the module is flagged as ADOPTME on CPAN, and the git repository is archived as read-only, which prevents issues and pull requests from being created.\n\nUsers are advised to find an alternative solution.\n\nFor users who are unable to migrate to an alternative, install Crypt::URandom::MonkeyPatch (which will override the built-in rand with a wrapper around Crypt::URandom) and apply the patch."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-17T17:29:10.397745Z", "id": "CVE-2026-13082", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T17:29:23.536Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-13082", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T17:29:10.397745Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T17:29:03.597Z"}}], "cna": {"title": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/burak/CPAN-GD-SecurityImage", "vendor": "BURAK", "product": "GD::SecurityImage", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.75"}], "packageName": "GD-SecurityImage", "programFiles": ["lib/GD/SecurityImage.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "GD::SecurityImage::random"}, {"name": "GD::SecurityImage::random_angle"}, {"name": "GD::SecurityImage::particle"}]}], "timeline": [{"lang": "en", "time": "2018-12-24T00:00:00.000Z", "value": "Version 1.75 released."}, {"lang": "en", "time": "2026-03-10T00:00:00.000Z", "value": "The git repository was archived."}], "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2025-40916", "tags": ["related"]}, {"url": "https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "GD::SecurityImage has not been updated since 2018, the module is flagged as ADOPTME on CPAN, and the git repository is archived as read-only, which prevents issues and pull requests from being created.\n\nUsers are advised to find an alternative solution.\n\nFor users who are unable to migrate to an alternative, install Crypt::URandom::MonkeyPatch (which will override the built-in rand with a wrapper around Crypt::URandom) and apply the patch."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.\n\nThe random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.\n\nThe built-in rand function is unsuitable for security applications because it is predictable and reversible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-804", "description": "CWE-804 Guessable CAPTCHA"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-17T12:54:07.177Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13082", "state": "PUBLISHED", "dateUpdated": "2026-07-17T17:29:23.536Z", "dateReserved": "2026-06-23T18:17:08.243Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-17T12:54:07.177Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "GD-SecurityImage", "product": "GD::SecurityImage", "programFiles": ["lib/GD/SecurityImage.pm"], "programRoutines": [{"name": "GD::SecurityImage::random"}, {"name": "GD::SecurityImage::random_angle"}, {"name": "GD::SecurityImage::particle"}], "repo": "https://github.com/burak/CPAN-GD-SecurityImage", "vendor": "BURAK", "versions": [{"lessThanOrEqual": "1.75", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.\n\nThe random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.\n\nThe built-in rand function is unsuitable for security applications because it is predictable and reversible."}, {"lang": "es", "value": "Las versiones de GD::SecurityImage hasta la 1.75 para Perl usan rand para generar secretos.\n\nEl m\u00e9todo aleatorio crea el texto de desaf\u00edo usado para el CAPTCHA muestreando caracteres de un array usando la funci\u00f3n rand incorporada de Perl, y genera una cadena (por defecto) de seis caracteres.\n\nLa funci\u00f3n rand incorporada no es adecuada para aplicaciones de seguridad porque es predecible y reversible."}], "id": "CVE-2026-13082", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13082", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-17T17:29:10.397745Z", "version": "2.0.3"}}]}, "published": "2026-07-17T13:17:55.443", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://www.cve.org/CVERecord?id=CVE-2025-40916"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-804"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.75]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "GD::SecurityImage", "source": "cna", "vendor": "BURAK"}, "product": "gd::securityimage", "vendor": "burak"}], "created": "2026-07-22T03:00:10.496181+00:00", "updated": "2026-07-31T00:30:18.827267+00:00", "vendors": ["burak", "burak$PRODUCT$gd::securityimage"]}