Source: libgd-securityimage-perl Version: 1.75-3 Severity: important Tags: upstream X-Debbugs-Cc: [email protected]
Hi, The following vulnerability was published for libgd-securityimage-perl. CVE-2026-13082[0]: | GD::SecurityImage versions through 1.75 for Perl use rand to | generate secrets. The random method creates the challenge text used | for the CAPTCHA by sampling characters from an array using Perl's | built-in rand function, and generates a (by default) six-character | string. The built-in rand function is unsuitable for security | applications because it is predictable and reversible. Given the module has not seen any updates since 2018 and is archived I think we should keep the module out of testing (I know there are some important reverse dependencies) and not release it with forky. The advisory advises to find alternative solutions so likely the reverse dependencies should move away from the module? I will fill a separate bug for that. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-13082 https://www.cve.org/CVERecord?id=CVE-2026-13082 [1] https://lists.security.metacpan.org/cve-announce/msg/41903267/ Regards, Salvatore
