[<prev] [next>] [day] [month] [year] [list]
Message-ID: <b27e93cf-fa71-4a7e-80f5-4f714866caaf@cpan.org>
Date: Mon, 11 Aug 2025 22:13:26 +0100
From: Robert Rothenberg <rrwo@...n.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-40920: Catalyst::Authentication::Credential::HTTP versions
1.018 and earlier for Perl use insecurely generated nonces
========================================================================
CVE-2025-40920 CPAN Security Group
========================================================================
CVE ID: CVE-2025-40920
Distribution: Catalyst-Authentication-Credential-HTTP
Versions: from 0.06 through 1.018
MetaCPAN:
https://metacpan.org/dist/Catalyst-Authentication-Credential-HTTP
VCS Repo:
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier
for Perl use insecurely generated nonces
Description
-----------
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier
for Perl generate nonces using the Perl Data::UUID library.
* Data::UUID does not use a strong cryptographic source for generating
UUIDs.
* Data::UUID returns v3 UUIDs, which are generated from known
information and are unsuitable for security, as per RFC 9562.
* The nonces should be generated from a strong cryptographic source, as
per RFC 7616.
Problem types
-------------
- CWE-340 Generation of Predictable Numbers or Identifiers
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
References
----------
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/pull/1
https://metacpan.org/release/ETHER/Catalyst-Authentication-Credential-HTTP-1.018/source/lib/Catalyst/Authentication/Credential/HTTP.pm#L391
https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations
https://datatracker.ietf.org/doc/html/rfc7616#section-5.12
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
