libdata-entropy-perl - Debian Package Tracker

general

source: libdata-entropy-perl (main)
version: 0.008-1
maintainer: Debian Perl Group (archive) (DMD) (LowNMU)
uploaders: Xavier Guimard (DMD) – Ivan Kohler (DMD)
arch: all
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.007-3.1
o-o-sec: 0.007-3.1+deb11u1
oldstable: 0.007-4+deb12u1
stable: 0.008-1
testing: 0.008-1
unstable: 0.008-1

versioned links

0.007-3.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.007-3.1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.007-4+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.008-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libdata-entropy-perl

action needed

A new upstream version is available: 0.010 high

A new upstream version 0.010 is available, you should consider packaging it.

Created: 2026-10-14 Last update: 2026-11-11 11:47

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-18536: Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string. Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by rand_bits and rand_int for every application that selected one of these sources via with_entropy_source. The _checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.

Created: 2026-08-01 Last update: 2026-09-01 22:00

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-18536: Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string. Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by rand_bits and rand_int for every application that selected one of these sources via with_entropy_source. The _checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.

Created: 2026-08-01 Last update: 2026-09-01 22:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 0.008-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 32a57dd8200189c98e838abc48128145badb374f
Author: gregor herrmann <gregoa@debian.org>
Date:   Sat Nov 7 22:27:37 2026 +0100

    update changelog
    
    Gbp-Dch: Ignore

commit 95f333b06b8c80fa7b86485ef85245065e2bd558
Author: gregor herrmann <gregoa@debian.org>
Date:   Sat Nov 7 22:27:37 2026 +0100

    Convert debian/watch to version 5.

Created: 2026-11-07 Last update: 2026-11-07 22:20

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-18536: (needs triaging) Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string. Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by rand_bits and rand_int for every application that selected one of these sources via with_entropy_source. The _checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-08-01 Last update: 2026-09-01 22:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

news

[rss feed]

[2025-04-14] Accepted libdata-entropy-perl 0.007-4+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Adrian Bunk)
[2025-04-01] libdata-entropy-perl 0.008-1 MIGRATED to testing (Debian testing watch)
[2025-03-31] Accepted libdata-entropy-perl 0.007-3.1+deb11u1 (source) into oldstable-security (Adrian Bunk)
[2025-03-29] Accepted libdata-entropy-perl 0.008-1 (source) into unstable (gregor herrmann)
[2022-06-17] libdata-entropy-perl 0.007-4 MIGRATED to testing (Debian testing watch)
[2022-06-12] Accepted libdata-entropy-perl 0.007-4 (source) into unstable (Jelmer Vernooĳ) (signed by: Jelmer Vernooij)
[2021-01-04] libdata-entropy-perl 0.007-3.1 MIGRATED to testing (Debian testing watch)
[2021-01-02] Accepted libdata-entropy-perl 0.007-3.1 (source) into unstable (Holger Levsen)
[2015-06-15] libdata-entropy-perl 0.007-3 MIGRATED to testing (Britney)
[2013-05-05] libdata-entropy-perl 0.007-2 MIGRATED to testing (Debian testing watch)
[2013-04-03] Accepted libdata-entropy-perl 0.007-2 (source all) (Xavier Guimard) (signed by: gregor herrmann)
[2011-05-20] libdata-entropy-perl 0.007-1 MIGRATED to testing (Debian testing watch)
[2011-05-09] Accepted libdata-entropy-perl 0.007-1 (source all) (Jotam Jr. Trejo) (signed by: gregor herrmann)
[2010-05-04] libdata-entropy-perl 0.006-1 MIGRATED to testing (Debian testing watch)
[2010-04-24] Accepted libdata-entropy-perl 0.006-1 (source all) (Ivan Kohler)
[2009-04-08] libdata-entropy-perl 0.005-1 MIGRATED to testing (Debian testing watch)
[2009-03-28] Accepted libdata-entropy-perl 0.005-1 (source all) (Ivan Kohler)
[2008-03-08] libdata-entropy-perl 0.004-1 MIGRATED to testing (Debian testing watch)
[2008-02-27] Accepted libdata-entropy-perl 0.004-1 (source all) (Ivan Kohler)
[2007-04-20] libdata-entropy-perl 0.003-1 MIGRATED to testing (Debian testing watch)
[2007-04-09] Accepted libdata-entropy-perl 0.003-1 (source all) (Ivan Kohler)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.008-1