Güvenlik Danışarlıklarına Dön

Net::EasyTCP Vulnerability — Ubuntu Security Update (USN-8985-1)

USN-8985-1 fixes CVE-2024-56830 in Perl's Net::EasyTCP module: it used the built-in rand() function to generate encryption keys when no strong randomization module was present, letting attackers predict session keys (CWE-338, CVSS 5.4). Update: sudo apt update && sudo apt upgrade libnet-easytcp-perl and restart Perl services using the module.

High 5.4 CVSS
Ubuntu 20.04 Ubuntu 22.04

SharedLicense lisansı altında bunun anlamı

Predictable encryption keys mean an attacker can decrypt session traffic — the module's encryption becomes theater rather than protection.

  1. Ubuntu Security Notices

  2. USN-8985-1

Publication date

3 November 2026

Overview

Net::EasyTCP could be made to expose sensitive information over the
network.

Releases


24.04 LTS


22.04 LTS


20.04 LTS


18.04 LTS


16.04 LTS

Packages

Details

It was discovered that Net::EasyTCP used the built-in Perl rand() function
to generate encryption keys when no strong randomization module was
present. An attacker could possibly use this issue to predict the keys and
obtain sensitive information.

It was discovered that Net::EasyTCP used the built-in Perl rand() function
to generate encryption keys when no strong randomization module was
present. An attacker could possibly use this issue to predict the keys and
obtain sensitive information.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
24.04 LTS noble libnet-easytcp-perl –  0.26-6+deb11u1build0.24.04.1
22.04 LTS jammy libnet-easytcp-perl –  0.26-4ubuntu0.22.04.1~esm1 Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.
20.04 LTS focal libnet-easytcp-perl –  0.26-4ubuntu0.20.04.1~esm1 Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.
18.04 LTS bionic libnet-easytcp-perl –  0.26-4ubuntu0.18.04.1~esm1 Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.
16.04 LTS xenial libnet-easytcp-perl –  0.26-3ubuntu0.1~esm1

References

Sıkça Sorulan Sorular

What is CVE-2024-56830?
It is a weak-randomness flaw (CWE-338) in Perl's Net::EasyTCP module: encryption keys were generated with the built-in rand() function when no strong randomization module was available, letting attackers predict session keys. CVSS 5.4; fixed in USN-8985-1.
Who is affected?
Systems running Perl applications that use Net::EasyTCP for encrypted communication — especially where the strong-randomness dependency was missing, which silently downgrades key generation.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade libnet-easytcp-perl and restart the Perl services using the module so new sessions use strong keys.
Why does predictable key generation matter?
If session keys come from a predictable sequence, an attacker who observes a few sessions can compute the generator state and decrypt subsequent sessions — the encryption provides no real confidentiality.

Referanslar

Güvenlik Danışarlıkları

İlgili Danışarlıklar

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

2026-11-12

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Sisteminizi güvenlik açıkları açısından kontrol edin

Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.

Sisteminizi Kontrol Edin