blob: acf52db52d5a0bc04963923c055b0f576c09d8d6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
https://security.metacpan.org/patches/B/Bytes-Random-Secure/0.29/CVE-2026-11625-r1.patch
https://bugs.gentoo.org/979426
From: Robert Rothenberg <perl@rhizomnic.com>
Date: Thu, 25 Jun 2026 14:43:11 +0100
Subject: [PATCH] Fix for CVE-2026-11625
--- a/lib/Bytes/Random/Secure.pm
+++ b/lib/Bytes/Random/Secure.pm
@@ -156,6 +156,7 @@ sub _build_attributes {
$self->{$arg} = exists $args->{$arg} ? $args->{$arg} : $default;
}
+ $self->{_pid} = $$;
$self->{_RNG} = undef; # Lazy initialization.
return $self;
}
@@ -171,6 +172,8 @@ sub _instantiate_rng {
my @seeds = $self->_generate_seed( %seed_opts );
$self->{_RNG} = Math::Random::ISAAC->new(@seeds);
+ $self->{_pid} = $$;
+
return $self->{_RNG};
}
@@ -224,7 +227,7 @@ sub bytes {
$bytes = defined $bytes ? $bytes : 0; # Default to zero bytes.
$self->_validate_int( $bytes ); # Throws on violation.
- $self->_instantiate_rng unless defined $self->{_RNG};
+ $self->_instantiate_rng unless $$ == $self->{_pid} && defined $self->{_RNG};
my $str = '';
@@ -302,7 +305,7 @@ sub _ranged_randoms {
$count = defined $count ? $count : 0;
# Lazily seed the RNG so we don't waste available strong entropy.
- $self->_instantiate_rng unless defined $self->{_RNG};
+ $self->_instantiate_rng unless $$ == $self->{_pid} && defined $self->{_RNG};
my $divisor = $self->_closest_divisor($range);
@@ -354,7 +357,7 @@ sub _closest_divisor {
sub irand {
my( $self ) = @_;
- $self->_instantiate_rng unless defined $self->{_RNG};
+ $self->_instantiate_rng unless $$ == $self->{_pid} && defined $self->{_RNG};
return $self->{_RNG}->irand;
}
|
