CVE-2025-15618: Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key

[Robert Rothenberg <rrwo () cpansec org>]

========================================================================
CVE-2025-15618                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2025-15618
  Distribution:  Business-OnlinePayment-StoredTransaction
      Versions:  through 0.01

      MetaCPAN: 
https://metacpan.org/dist/Business-OnlinePayment-StoredTransaction


Business::OnlinePayment::StoredTransaction versions through 0.01 for
Perl uses an insecure secret key

Description
-----------
Business::OnlinePayment::StoredTransaction versions through 0.01 for
Perl uses an insecure secret key.

Business::OnlinePayment::StoredTransaction generates a secret key by
using a MD5 hash of a single call to the built-in rand function, which
is unsuitable for cryptographic use.

This key is intended for encrypting credit card transaction data.

Problem types
-------------
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
- CWE-693 Protection Mechanism Failure

Workarounds
-----------
Apply the patch that uses Crypt::URandom to generate a secret key.


References
----------
https://metacpan.org/dist/Business-OnlinePayment-StoredTransaction/source/lib/Business/OnlinePayment/StoredTransaction.pm#L64-75
https://security.metacpan.org/patches/B/Business-OnlinePayment-StoredTransaction/0.01/CVE-2025-15618-r1.patch