Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-40920

Summary
Assigner-CPANSec
Assigner Org ID-9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At-11 Aug, 2025 | 20:19
Updated At-11 Aug, 2025 | 20:52
Rejected At-
Credits

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs. * Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562. * The nonces should be generated from a strong cryptographic source, as per RFC 7616.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:CPANSec
Assigner Org ID:9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At:11 Aug, 2025 | 20:19
Updated At:11 Aug, 2025 | 20:52
Rejected At:
▼CVE Numbering Authority (CNA)
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs. * Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562. * The nonces should be generated from a strong cryptographic source, as per RFC 7616.

Affected Products
Vendor
ETHER
Product
Catalyst::Authentication::Credential::HTTP
Collection URL
https://cpan.org/modules
Package Name
Catalyst-Authentication-Credential-HTTP
Repo
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP
Default Status
unaffected
Versions
Affected
  • From 0.06 through 1.018 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-340CWE-340 Generation of Predictable Numbers or Identifiers
CWECWE-338CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Type: CWE
CWE ID: CWE-340
Description: CWE-340 Generation of Predictable Numbers or Identifiers
Type: CWE
CWE ID: CWE-338
Description: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch
patch
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/pull/1
issue-tracking
https://metacpan.org/release/ETHER/Catalyst-Authentication-Credential-HTTP-1.018/source/lib/Catalyst/Authentication/Credential/HTTP.pm#L391
N/A
https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations
N/A
https://datatracker.ietf.org/doc/html/rfc7616#section-5.12
N/A
Hyperlink: https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch
Resource:
patch
Hyperlink: https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/pull/1
Resource:
issue-tracking
Hyperlink: https://metacpan.org/release/ETHER/Catalyst-Authentication-Credential-HTTP-1.018/source/lib/Catalyst/Authentication/Credential/HTTP.pm#L391
Resource: N/A
Hyperlink: https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations
Resource: N/A
Hyperlink: https://datatracker.ietf.org/doc/html/rfc7616#section-5.12
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
3.18.6HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Version: 3.1
Base score: 8.6
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At:11 Aug, 2025 | 21:15
Updated At:12 Aug, 2025 | 14:25

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs. * Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562. * The nonces should be generated from a strong cryptographic source, as per RFC 7616.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.6HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Type: Secondary
Version: 3.1
Base score: 8.6
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-338Secondary9b29abf9-4ab0-4765-b253-1875cd9b441e
CWE-340Secondary9b29abf9-4ab0-4765-b253-1875cd9b441e
CWE ID: CWE-338
Type: Secondary
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
CWE ID: CWE-340
Type: Secondary
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://datatracker.ietf.org/doc/html/rfc7616#section-5.129b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations9b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch9b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/pull/19b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
https://metacpan.org/release/ETHER/Catalyst-Authentication-Credential-HTTP-1.018/source/lib/Catalyst/Authentication/Credential/HTTP.pm#L3919b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
Hyperlink: https://datatracker.ietf.org/doc/html/rfc7616#section-5.12
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A
Hyperlink: https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A
Hyperlink: https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A
Hyperlink: https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/pull/1
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A
Hyperlink: https://metacpan.org/release/ETHER/Catalyst-Authentication-Credential-HTTP-1.018/source/lib/Catalyst/Authentication/Credential/HTTP.pm#L391
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

0Records found
Details not found