Amazon::Credentials versions up to 1.2.0 use the Perl built-in rand function to generate 64-bit encryption keys for obfuscating stored credentials. Since rand is a predictable and cryptographically weak PRNG, the encryption keys can be potentially guessed, undermining the confidentiality of the stored secrets. This vulnerability is classified under CWE-338 (Use of Cryptographically Weak PRNG). No CVSS score is assigned, and no official patch or remediation level is indicated in the available data.

The use of a predictable PRNG for key generation compromises the encryption of stored credentials, potentially allowing attackers to recover sensitive secrets from data dumps of the object. This weakens the confidentiality guarantees of the Amazon::Credentials module prior to version 1.3.0. There are no known exploits in the wild reported at this time.

Upgrade to Amazon::Credentials version 1.3.0 or later, where the use of the built-in rand function for key generation has been replaced with a more secure method. Since no official patch or advisory is provided, users should verify the version in use and update accordingly to mitigate this vulnerability. Patch status is not yet confirmed by a vendor advisory; check for official updates.