CVE-2025-40920

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-40920
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40920.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-40920
Published
2025-08-11T21:15:28Z
Modified
2025-08-12T15:59:14.669819Z
Summary
[none]
Details

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs. * Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562. * The nonces should be generated from a strong cryptographic source, as per RFC 7616.

References

Affected packages

Debian:11 / libcatalyst-authentication-credential-http-perl

Package

Name
libcatalyst-authentication-credential-http-perl
Purl
pkg:deb/debian/libcatalyst-authentication-credential-http-perl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.018-1
1.018-2
1.018-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / libcatalyst-authentication-credential-http-perl

Package

Name
libcatalyst-authentication-credential-http-perl
Purl
pkg:deb/debian/libcatalyst-authentication-credential-http-perl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.018-2
1.018-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / libcatalyst-authentication-credential-http-perl

Package

Name
libcatalyst-authentication-credential-http-perl
Purl
pkg:deb/debian/libcatalyst-authentication-credential-http-perl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.018-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / libcatalyst-authentication-credential-http-perl

Package

Name
libcatalyst-authentication-credential-http-perl
Purl
pkg:deb/debian/libcatalyst-authentication-credential-http-perl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.018-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/perl-catalyst/catalyst-authentication-credential-http

Affected ranges

Type
GIT
Repo
https://github.com/perl-catalyst/catalyst-authentication-credential-http
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ad2c03aad95406db4ce35dfb670664ebde004c18