CVE-2025-40920: falha de alta gravidade em ETHER Catalyst::Authentication::Credential::HTTP
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar Catalyst::Authentication::Credential::HTTP+ Monitorar libcatalyst-authentication-credential-http-perl
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.5%
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.
* Data::UUID does not use a strong cryptographic source for generating UUIDs.
* Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.
* The nonces should be generated from a strong cryptographic source, as per RFC 7616.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Produtos afetados
ETHER · Catalyst::Authentication::Credential::HTTPReferências
https://datatracker.ietf.org/doc/html/rfc7616#section-5.12https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerationshttps://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/pull/1https://metacpan.org/release/ETHER/Catalyst-Authentication-Credential-HTTP-1.018/source/lib/Catalyst/Authentication/Credential/HTTP.pm#L391https://security.metacpan.org/patches/C/Catalyst-Authentication-Credential-HTTP/1.018/CVE-2025-40920-r1.patchhttp://www.openwall.com/lists/oss-security/2025/08/12/1