Bug#1092056: libnet-oauth-perl: CVE-2025-22376: Default nonce for Net::OAuth package for perl is not cryptographically strong

[Salvatore Bonaccorso]

Source: libnet-oauth-perl
Version: 0.28-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 0.28-3

Hi,

The following vulnerability was published for libnet-oauth-perl.

CVE-2025-22376[0]:
| In Net::OAuth::Client in the Net::OAuth package before 0.29 for
| Perl, the default nonce is a 32-bit integer generated from the
| built-in rand() function, which is not cryptographically strong.

Fixed in 0.30 upstream with a followup bugfix and adding the
Crypt::URandom dependency.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-22376
    https://www.cve.org/CVERecord?id=CVE-2025-22376

Regards,
Salvatore