CVE-2025-40920 Details

A vulnerability exists in the Catalyst::Authentication::Credential::HTTP module for Perl, specifically in versions through 1.018. The issue arises from the use of the Data::UUID library to generate nonces for HTTP Digest authentication. Data::UUID is not cryptographically secure and produces version 3 UUIDs, which are generated from known information and deemed unsuitable for security purposes, according to RFC 9562. This flaw violates the nonce generation requirements outlined in RFC 7616, which call for nonces to be derived from a strong cryptographic source.

Update to a version of Catalyst::Authentication::Credential::HTTP that uses Crypt::SysRandom for nonce generation instead of Data::UUID. Instructions for updating can be found in the project's VCS repository.