diff options
| author | Rodrigo Osorio <rodrigo@FreeBSD.org> | 2025-08-24 13:41:31 +0200 |
|---|---|---|
| committer | Rodrigo Osorio <rodrigo@FreeBSD.org> | 2025-08-24 13:42:50 +0200 |
| commit | 35f7214f7a9ec55b15024145c227dcb86b55be71 (patch) | |
| tree | 7c202644a3aec7664b1cfb765ad5f68c5b24dcc5 | |
| parent | www/p5-Catalyst-Authentication-Credential-HTTP: update to 1.019 (diff) | |
security/vuxml: add p5-Catalyst-Authentication-Credential-HTTP
| -rw-r--r-- | security/vuxml/vuln/2025.xml | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index 7bf627363764..acb32c2444fe 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,3 +1,32 @@ + <vuln vid="c323bab5-80dd-11f0-97c4-40b034429ecf"> + <topic>p5-Catalyst-Authentication-Credential-HTTP -- Insecure source of randomness</topic> + <affects> + <package> + <name>p5-Catalyst-Authentication-Credential-HTTP</name> + <range><lt>1.019</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>perl-catalyst project reports:</p> + <blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2025-40920"> + <p>Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using + the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating + UUIDs.* Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for + security, as per RFC 9562. * The nonces should be generated from a strong cryptographic source, as per RFC 7616.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2025-40920</cvename> + <url>https://nvd.nist.gov/vuln/detail/CVE-2025-40920</url> + </references> + <dates> + <discovery>2025-08-11</discovery> + <entry>2025-08-24</entry> + </dates> + </vuln> + <vuln vid="07335fb9-7eb1-11f0-ba14-b42e991fc52e"> <topic>Mozilla -- memory safety bugs</topic> <affects> |