Mojolicious::Plugin::CaptchaPNG Weak Random Number Generation Vulnerability

A vulnerability exists in Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl, where a weak random number generator is used for creating captcha text and image noise. The plugin relies on the built-in rand() function, which is not secure for generating random data needed for captchas. This issue allows for potential prediction of captcha values, undermining the effectiveness of the captcha mechanism.

Impact

Exploitation of this vulnerability could lead to captchas being easily bypassed or manipulated, as the predictability of the random number generation could be exploited to anticipate captcha values.

Remediation

Users can upgrade to Mojolicious::Plugin::CaptchaPNG version 1.06 or later, which addresses this vulnerability by using Crypt::URandom for secure random number generation. Instructions for updating can be found on MetaCPAN.