PT-2025-29832 · Unknown · Authen::Digestmd5

Salva + 1 · Published 2025-07-16 · Updated 2025-07-16 · CVE-2025-40919

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Authen::DigestMD5 versions 0.01 through 0.02

Description The cnonce (client nonce) is generated insecurely using an MD5 hash of the PID, the epoch time, and the built-in rand function. The PID originates from a limited set of numbers, and the epoch time may be predictable. The rand function is unsuitable for cryptographic purposes. RFC 2831 recommends that the cnonce contain at least 64 bits of entropy to avoid chosen plaintext attacks and provide mutual authentication.

Recommendations Authen::DigestMD5 version 0.01: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Authen::DigestMD5 version 0.02: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-340

CWE-338

Related Identifiers

CVE-2025-40919

Affected Products

Authen::Digestmd5

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-40919 · Security Note
• https://twitter.com/CVEnew/status/1945562962258796926 · Twitter Post
• https://datatracker.ietf.org/doc/html/rfc2831 · Note
• https://t.me/cvenotify/129240 · Telegram Post
• https://metacpan.org/release/SALVA/Authen-DigestMD5-0.01/source/DigestMD5.pm#L126 · Note