CVE-2026-6146mediumCWE-338

CVE-2026-6146: falha de média gravidade em BIGFOOT Amazon::Credentials

Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys

Publicada em 11 mai 2026 · Atualizada em 13 mai 2026

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%

probabilidade de exploração

0.3%top 84% das CVEs

exploração observada

nãonenhuma fonte reporta

Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys. Amazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object. Before version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Produtos afetados

BIGFOOT · Amazon::Credentials

Referências

https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.2.0/source/lib/Amazon/Credentials.pm#L1415-1418 https://metacpan.org/release/BIGFOOT/Amazon-Credentials-1.3.0/changes http://www.openwall.com/lists/oss-security/2026/05/11/15