CVE-2025-40920: Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces

[Robert Rothenberg <rrwo () cpan org>]

========================================================================
CVE-2025-40920                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2025-40920
  Distribution:  Catalyst-Authentication-Credential-HTTP
      Versions:  from 0.06 through 1.018

      MetaCPAN: 
https://metacpan.org/dist/Catalyst-Authentication-Credential-HTTP
      VCS Repo: 
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP


Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier
for Perl use insecurely generated nonces

Description
-----------
Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier
for Perl generate nonces using the Perl Data::UUID library.

* Data::UUID does not use a strong cryptographic source for generating
  UUIDs.

* Data::UUID returns v3 UUIDs, which are generated from known
  information and are unsuitable for security, as per RFC 9562.

* The nonces should be generated from a strong cryptographic source, as
  per RFC 7616.

Problem types
-------------
- CWE-340 Generation of Predictable Numbers or Identifiers
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator

References
----------
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch
https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/pull/1
https://metacpan.org/release/ETHER/Catalyst-Authentication-Credential-HTTP-1.018/source/lib/Catalyst/Authentication/Credential/HTTP.pm#L391
https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations
https://datatracker.ietf.org/doc/html/rfc7616#section-5.12