BSD Portsp5-Authen-SASL -- Insecure source of randomness
· CVE-2025-40918 · VuXML entry
p5-Authen-SASL project reports: Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely. The cnonce (client nonce) is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable …
Affected versions
- p5-Authen-SASL < 2.1900
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/p5-Authen-SASL | 2.17_1 | vulnerable since 2025-08-13 | |
| OpenBSD | security/p5-Authen-SASL | 2.2100 | out of range, by version | |
| NetBSD | security/p5-Authen-SASL | 2.2100 | not listed | |
| MidnightBSD | security/p5-Authen-SASL | 2.1900 | out of range, by version | |
| FreeBSD | security/p5-Authen-SASL | 2.2100 | fixed | (406 days after) |