On this page (6 sections)
Ubuntu has published security notice USN-8985-1 on 3 November 2026 for Net::EasyTCP, a Perl module for building TCP/IP clients and servers. According to the notice, the module used Perl's built-in rand() function to generate encryption keys when no strong randomization module was present, which could let an attacker predict those keys.
If you run Perl-based network services on Ubuntu, or manage servers where the libnet-easytcp-perl package may have been installed as a dependency, it is worth a quick check. The package is niche, so most sites are not affected, but the check takes a minute.
What the notice says
Ubuntu describes the issue in one sentence: Net::EasyTCP used Perl's built-in rand() function to generate encryption keys when no strong randomization module was present. The notice says an attacker could possibly use this to predict the keys and obtain sensitive information. Ubuntu's overview summarizes the impact as the software being made to expose sensitive information over the network.
The notice references CVE-2024-56830. The research for this story does not include a CVSS score, a CVE record or any statement about exploitation in the wild, so this article does not assign a severity. Only one publisher, Ubuntu, covers this so far, and no independent confirmation is available.
Why predictable keys matter
Encryption is only as strong as the secrecy of its keys. Perl's rand() is a general-purpose pseudo-random generator meant for things like shuffling or simulations, not for cryptography. Its output follows a deterministic sequence, so if an attacker can guess or narrow down the starting state, they may be able to reproduce the keys that were derived from it.
The notice says the problem occurs when no strong randomization module is present. In plain terms, the module appears to fall back to the weak generator when a better source is not available. Whether a particular system is affected therefore depends on how it is set up, and the notice does not detail which modules count as strong. Treat any system with the package installed as in scope until it is updated.
Who is exposed
- Servers running custom or legacy Perl applications that use Net::EasyTCP for client-server communication.
- Systems where libnet-easytcp-perl was pulled in as a dependency of some other Perl software.
- Older Ubuntu LTS releases (22.04, 20.04, 18.04), where the notice says the fix is available with Ubuntu Pro via ESM Apps rather than through a standard update.
Ubuntu's notice states that a community fix might become publicly available in the future for 22.04, 20.04 and 18.04. If you are not on Ubuntu Pro, plan for that gap: either enable it (Ubuntu says it is free for up to five machines), or consider replacing the module or isolating the service.
How to check your exposure
This read-only command, run on the server, shows whether libnet-easytcp-perl is installed and which version. An error saying no packages were found, or a status other than installed, means this notice does not apply to that machine.
dpkg -l libnet-easytcp-perlTo see which installed packages depend on it, so you know what would be affected by an update, run this read-only query.
apt-cache rdepends --installed libnet-easytcp-perlCompare the installed version with the fixed versions in the table below.
| Ubuntu release | Fixed version | How to get it |
|---|---|---|
| 24.04 LTS (noble) | 0.26-6+deb11u1build0.24.04.1 | Standard update |
| 22.04 LTS (jammy) | 0.26-4ubuntu0.22.04.1~esm1 | Ubuntu Pro (ESM Apps) |
| 20.04 LTS (focal) | 0.26-4ubuntu0.20.04.1~esm1 | Ubuntu Pro (ESM Apps) |
| 18.04 LTS (bionic) | 0.26-4ubuntu0.18.04.1~esm1 | Ubuntu Pro (ESM Apps) |
| 16.04 LTS (xenial) | 0.26-3ubuntu0.1~esm1 | See the Ubuntu notice for access details |
What to do now
Ubuntu says a standard system update will make the necessary changes. This command refreshes package lists and upgrades only the one package; run it with sudo and confirm the version afterward matches the table above.
sudo apt update && sudo apt install --only-upgrade libnet-easytcp-perl0 of 6 done
Monitoring afterward
Add libnet-easytcp-perl to whatever tracks your package versions so you notice if an old copy returns through a rebuild or image. If the service is internet-facing, keep an eye on unexpected connections to its port and on certificate or configuration changes. A monitoring service such as Webforta Monitor can watch uptime and certificate changes on public endpoints, though it will not tell you whether a Perl module is up to date. For broader hygiene, see website security for small business, or browse more advisories on the Webforta blog.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.