CVE-2026-6146 PUBLISHED

Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys

Assigner: CPANSec
Reserved: 12.04.2026 Published: 11.05.2026 Updated: 11.05.2026

Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.

Amazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object.

Before version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.

Product Status

Vendor BIGFOOT
Product Amazon::Credentials
Versions Default: unaffected
  • affected from 0 to 1.2.0 (incl.)

Solutions

Upgrade to version 1.3.0 or later.

References

Problem Types

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) CWE