========================================================================
CVE-2025-40920 CPAN Security Group
========================================================================
CVE ID: CVE-2025-40920
Distribution: Catalyst-Authentication-Credential-HTTP
Versions: from 0.06 through 1.018
MetaCPAN:
https://metacpan.org/dist/Catalyst-Authentication-Credential-HTTP
VCS Repo:
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier
for Perl use insecurely generated nonces
Description
-----------
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier
for Perl generate nonces using the Perl Data::UUID library.
* Data::UUID does not use a strong cryptographic source for generating
UUIDs.
* Data::UUID returns v3 UUIDs, which are generated from known
information and are unsuitable for security, as per RFC 9562.
* The nonces should be generated from a strong cryptographic source, as
per RFC 7616.
Problem types
-------------
- CWE-340 Generation of Predictable Numbers or Identifiers
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
References
----------
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/pull/1
https://metacpan.org/release/ETHER/Catalyst-Authentication-Credential-HTTP-1.018/source/lib/Catalyst/Authentication/Credential/HTTP.pm#L391
https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations
https://datatracker.ietf.org/doc/html/rfc7616#section-5.12
