Data::Entropy versions prior to 0.010 access remote entropy sources Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo over plain HTTP, exposing the data to interception and modification by on-path attackers such as those on open WiFi or compromised ISPs. The integrity check for RandomOrg is trivial and accepts any non-empty byte string, allowing attackers to substitute the entropy data arbitrarily. This enables attackers to control the output of rand_bits and rand_int functions for any application using these entropy sources via with_entropy_source. Additionally, the _checkbuf method's response is attacker-controlled, allowing manipulation of retry and sleep behavior.

An attacker positioned on the network path can intercept and modify the entropy data returned by the affected Data::Entropy remote sources. This compromises the confidentiality of the entropy data (high impact on confidentiality) but does not affect integrity or availability of the application directly. Applications relying on these entropy sources for randomness may be fed attacker-controlled data, potentially weakening cryptographic operations or other security mechanisms that depend on randomness.

A patch is available for Data::Entropy to address this issue. Since this is a cloud service, the vendor manages remediation server-side. Users should upgrade to version 0.010 or later to ensure entropy sources are accessed securely. Check the vendor advisory for confirmation of patch deployment and further guidance.