CVE-2024-52322

Name of the Vulnerable Software and Affected Versions WebService::Xero versions 0.11 and earlier

Description The issue concerns the use of a non-cryptographically secure source of entropy for cryptographic functions. Specifically, WebService::Xero uses the Data::Random library, which relies on the rand() function. This library is intended for use in test programs, indicating its inadequacy for secure cryptographic operations.

Recommendations For WebService::Xero versions 0.11 and earlier, consider updating to a version that utilizes a cryptographically secure source of entropy for its cryptographic functions. As a temporary workaround, consider disabling the use of the Data::Random library until a secure alternative is implemented. Restrict access to cryptographic functions that rely on the rand() function to minimize the risk of exploitation.