CVE-2025-22376: 
Linux Debian vulnerability analysis and mitigation

In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong. The vulnerability was discovered and disclosed on January 3, 2025, affecting the OAuth authentication implementation in Perl applications using this package (Red Hat CVE, Debian Tracker).

The vulnerability stems from the use of Perl's built-in rand() function to generate nonces in the OAuth authentication process. The nonce, which should be a unique value for each request, is generated as a 32-bit integer using a non-cryptographically secure random number generator. This implementation exists in the makerequest method of Net::OAuth::Client. The vulnerability has been assigned a CVSS v3.1 base score of 4.8, indicating moderate severity (Red Hat CVE).

The use of a weak random number generator for nonce generation could potentially allow attackers to predict future nonce values. While the direct impact depends heavily on implementation context, it could enable targeted denial-of-service attacks or, in specific circumstances, replay attacks against OAuth authentication flows. The vulnerability primarily affects availability with limited potential impact on integrity and confidentiality (Vulnarium Blog).

The issue has been fixed in Net::OAuth version 0.29 by replacing the weak random number generator with Crypt::URandom for nonce generation. The fix uses unpack("H*", urandom(16)) to generate cryptographically secure random nonces (GitHub Commit, CPAN Changes).

The security community has generally assessed this vulnerability as less severe than initially indicated by its high CVSS score. Security researchers have noted that while the vulnerability represents a legitimate security concern, its practical impact is limited in most deployment scenarios. The vulnerability has been characterized as one that can be addressed during regular maintenance cycles rather than requiring immediate emergency patching (Vulnarium Blog).