Bug#1102148: libweb-api-perl: CVE-2024-57868

[Salvatore Bonaccorso]

Source: libweb-api-perl
Version: 2.8-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 2.7-2
Control: found -1 2.7-1

Hi,

The following vulnerability was published for libweb-api-perl.

CVE-2024-57868[0]:
| Web::API 2.8 and earlier for Perl uses the rand() function as the
| default source of entropy, which is not cryptographically secure,
| for cryptographic functions.  Specifically Web::API uses the
| Data::Random library which specifically states that it is "Useful
| mostly for test programs". Data::Random uses the rand() function.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-57868
    https://www.cve.org/CVERecord?id=CVE-2024-57868
[1] https://lists.security.metacpan.org/cve-announce/msg/28503730/

Regards,
Salvatore