Back to Security Advisories

Net::EasyTCP Vulnerability — Ubuntu Security Update (USN-8985-1)

USN-8985-1 fixes CVE-2024-56830 in Perl's Net::EasyTCP module: it used the built-in rand() function to generate encryption keys when no strong randomization module was present, letting attackers predict session keys (CWE-338, CVSS 5.4). Update: sudo apt update && sudo apt upgrade libnet-easytcp-perl and restart Perl services using the module.

High 5.4 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

Predictable encryption keys mean an attacker can decrypt session traffic — the module's encryption becomes theater rather than protection.

  1. Ubuntu Security Notices

  2. USN-8985-1

Publication date

3 November 2026

Overview

Net::EasyTCP could be made to expose sensitive information over the
network.

Releases


24.04 LTS


22.04 LTS


20.04 LTS


18.04 LTS


16.04 LTS

Packages

Details

It was discovered that Net::EasyTCP used the built-in Perl rand() function
to generate encryption keys when no strong randomization module was
present. An attacker could possibly use this issue to predict the keys and
obtain sensitive information.

It was discovered that Net::EasyTCP used the built-in Perl rand() function
to generate encryption keys when no strong randomization module was
present. An attacker could possibly use this issue to predict the keys and
obtain sensitive information.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
24.04

LTS noble

 libnet-easytcp-perl – 

0.26-6+deb11u1build0.24.04.1
22.04

LTS jammy

 libnet-easytcp-perl – 

0.26-4ubuntu0.22.04.1~esm1

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

20.04

LTS focal

 libnet-easytcp-perl – 

0.26-4ubuntu0.20.04.1~esm1

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

18.04

LTS bionic

 libnet-easytcp-perl – 

0.26-4ubuntu0.18.04.1~esm1

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

16.04

LTS xenial

 libnet-easytcp-perl – 

0.26-3ubuntu0.1~esm1

References

Frequently Asked Questions

What is CVE-2024-56830?
It is a weak-randomness flaw (CWE-338) in Perl's Net::EasyTCP module: encryption keys were generated with the built-in rand() function when no strong randomization module was available, letting attackers predict session keys. CVSS 5.4; fixed in USN-8985-1.
Who is affected?
Systems running Perl applications that use Net::EasyTCP for encrypted communication — especially where the strong-randomness dependency was missing, which silently downgrades key generation.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade libnet-easytcp-perl and restart the Perl services using the module so new sessions use strong keys.
Why does predictable key generation matter?
If session keys come from a predictable sequence, an attacker who observes a few sessions can compute the generator state and decrypt subsequent sessions — the encryption provides no real confidentiality.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System