CVE-2025-40920 — Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces

Description

Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.
* Data::UUID does not use a strong cryptographic source for generating UUIDs.
* Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.
* The nonces should be generated from a strong cryptographic source, as per RFC 7616.

Affected products

Vendor	Product	Affected	Fixed
ETHER	Catalyst::Authentication::Credential::HTTP	0.06 – ≤ 1.018	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libcatalyst-authentication-credential-http-perl	1.018-4	—
Debian 13	libcatalyst-authentication-credential-http-perl	No fix yet	—
Debian 12	libcatalyst-authentication-credential-http-perl	No fix yet	—

Ubuntu