Debian 12 — libcatalyst-authentication-credential-http-perl — vulnerability — patch and remediation guide

📖 ~4 min read  •  Source: Debian Security Tracker

Related CVEs: CVE-2025-40920

Upstream summary: Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs. * Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562. * The nonces should be generated from a strong cryptographic source, as per RFC 7616.

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

On Debian 12 (bookworm) hosts that have libcatalyst-authentication-credential-http-perl installed, administrators observe behaviour consistent with Debian Security Tracker: apt reports pending security updates, services backed by libcatalyst-authentication-credential-http-perl fail or restart unexpectedly, and — for security-rated advisories — the host is exposed to the vulnerability set above. Impact ranges from a single service-restart loop to wider availability incidents whenever libcatalyst-authentication-credential-http-perl sits on the serving path.

Environment & Reproduction

Reproduction targets Debian 12 (bookworm). Confirm release and installed package:

cat /etc/debian_version
lsb_release -a 2>/dev/null || cat /etc/os-release
dpkg -l libcatalyst-authentication-credential-http-perl | tail -2
apt-cache policy libcatalyst-authentication-credential-http-perl
dpkg-query -W -f='${Status}\n' libcatalyst-authentication-credential-http-perl

Trigger the workflow that exposes libcatalyst-authentication-credential-http-perl — vulnerability — patch and remediation guide while collecting:

sudo journalctl -u libcatalyst-authentication-credential-http-perl -b --no-pager | tail -200
sudo journalctl -xe --no-pager | tail -200
sudo tail -200 /var/log/apt/history.log
sudo tail -200 /var/log/dpkg.log

Root Cause Analysis

Root cause is tracked at Debian Security Tracker. The Debian Security Team shipped fixes in the corresponding libcatalyst-authentication-credential-http-perl point release for Debian 12 (suite bookworm-security); running an outdated build leaves the host exposed to the failure modes referenced above. Correlate apt history with the journal:

grep -A2 -B2 libcatalyst-authentication-credential-http-perl /var/log/apt/history.log
zgrep -A2 -B2 libcatalyst-authentication-credential-http-perl /var/log/apt/history.log.*.gz 2>/dev/null
cat /proc/sys/kernel/tainted   # non-zero = tainted kernel / out-of-tree modules

Quick Triage

Run these on Debian 12 to capture the current state of libcatalyst-authentication-credential-http-perl:

dpkg -l libcatalyst-authentication-credential-http-perl | tail -1                   # installed version
dpkg -V libcatalyst-authentication-credential-http-perl                              # verify shipped files
sudo apt update && apt list --upgradable 2>/dev/null | grep -i security
systemctl --failed --no-pager
sudo nft list ruleset 2>/dev/null | head -50
sudo aa-status 2>/dev/null | head -20      # AppArmor profiles
# If libcatalyst-authentication-credential-http-perl ships a systemd unit (unit name may differ from pkg, e.g. bind9→named,
# postgresql-NN→postgresql@NN-main, php-fpm→php<ver>-fpm):
systemctl list-unit-files | grep -i libcatalyst | head

Step-by-Step Diagnosis

1. List failed systemd units.

   systemctl --failed --no-pager

2. Tail the journal for libcatalyst-authentication-credential-http-perl and the system bus.

   sudo journalctl -u libcatalyst-authentication-credential-http-perl -f --no-pager
   sudo journalctl -xe -f --no-pager

3. Inspect firewall state (this OS defaults to nftables).

   sudo nft list ruleset
   sudo nft list tables

4. Verify libcatalyst-authentication-credential-http-perl file integrity and reinstall if anything is altered.

   sudo dpkg -V libcatalyst-authentication-credential-http-perl
   sudo debsums -c libcatalyst-authentication-credential-http-perl 2>/dev/null
   sudo apt install --reinstall -y libcatalyst-authentication-credential-http-perl

5. Check AppArmor denials (Debian 11+ default-enabled).

   sudo journalctl -k | grep -i 'apparmor="DENIED"' | tail -30
   sudo aa-status | grep -i libcatalyst

6. Correlate findings with /var/log/apt/history.log, /var/log/dpkg.log, and Debian Security Tracker to pin the change that introduced libcatalyst-authentication-credential-http-perl — vulnerability — patch and remediation guide.

Solution – Primary Fix

Apply the corrective apt transaction documented in Debian Security Tracker from the security suite, then reload the affected unit:

sudo apt update
sudo apt -y install --only-upgrade libcatalyst-authentication-credential-http-perl
sudo systemctl daemon-reload
# Unit name may differ from package name; check first:
systemctl list-unit-files | grep -i libcatalyst | head
sudo systemctl restart libcatalyst-authentication-credential-http-perl
dpkg -l libcatalyst-authentication-credential-http-perl | tail -1                # confirm new version
systemctl is-active libcatalyst-authentication-credential-http-perl 2>/dev/null  # confirm running (if a unit exists)

For kernel / glibc / systemd / openssl advisories a reboot is required:

sudo apt install -y needrestart
sudo needrestart -r l       # list services that need restart
sudo systemctl reboot       # or: sudo shutdown -r now

Solution – Alternative Approaches

If the primary upgrade is not viable, pick from these:

• Pin a known-good version via apt preferences:

  # /etc/apt/preferences.d/libcatalyst-authentication-credential-http-perl.pref
  Package: libcatalyst-authentication-credential-http-perl
  Pin: version <good-version>
  Pin-Priority: 1001

• Mark the package on hold so apt cannot upgrade it:

  sudo apt-mark hold libcatalyst-authentication-credential-http-perl
  apt-mark showhold | grep libcatalyst-authentication-credential-http-perl
  # Release the hold later with:
  sudo apt-mark unhold libcatalyst-authentication-credential-http-perl

• Downgrade to an older NVR if a regression is suspected:

  apt-cache madison libcatalyst-authentication-credential-http-perl
  sudo apt install --allow-downgrades -y libcatalyst-authentication-credential-http-perl=<older-version>

• Switch firewall backend between iptables-legacy and nftables (Debian 10+):

  sudo update-alternatives --config iptables
  sudo update-alternatives --config ip6tables
  sudo systemctl restart netfilter-persistent 2>/dev/null

• Take only the security archive update and defer the full point-release upgrade:

  # /etc/apt/sources.list.d/bookworm-security-only.list
  deb http://security.debian.org/debian-security bookworm-security main contrib non-free
  # then:
  sudo apt update && sudo apt -y install --only-upgrade -t bookworm-security libcatalyst-authentication-credential-http-perl

• Investigate AppArmor blocking the new binary; switch the profile to complain mode briefly:

  sudo aa-complain /etc/apparmor.d/usr.sbin.libcatalyst-authentication-credential-http-perl 2>/dev/null
  # reproduce, capture denials, then re-enforce:
  sudo aa-enforce /etc/apparmor.d/usr.sbin.libcatalyst-authentication-credential-http-perl 2>/dev/null

Verification & Acceptance Criteria

All of these should pass after the fix is applied:

dpkg -l libcatalyst-authentication-credential-http-perl | tail -1                                  # expected fixed version
apt list --upgradable 2>/dev/null | grep -i security || echo OK
systemctl is-active libcatalyst-authentication-credential-http-perl 2>/dev/null                    # active (if a unit exists)
sudo journalctl -u libcatalyst-authentication-credential-http-perl --since "5 minutes ago" --no-pager   # no new errors
sudo nft list ruleset | head
sudo aa-status 2>/dev/null | head -5

The original reproduction for libcatalyst-authentication-credential-http-perl — vulnerability — patch and remediation guide must not trigger across two consecutive runs.

Rollback Plan

Capture state before any change:

apt list --installed 2>/dev/null > /root/apt-pre.txt
dpkg --get-selections > /root/dpkg-pre.txt
# LVM snapshot of the root LV (only if root sits on LVM):
sudo lvcreate -L 4G -s -n root_pre_patch /dev/<vg>/<root-lv>

To revert:

sudo apt install --allow-downgrades -y libcatalyst-authentication-credential-http-perl=<old-version>
sudo systemctl daemon-reload
sudo systemctl restart libcatalyst-authentication-credential-http-perl
# If a kernel was rolled back, reboot and select the previous kernel from GRUB:
sudo systemctl reboot
# LVM snapshot merge (offline / on next reboot):
sudo lvconvert --merge /dev/<vg>/root_pre_patch

Prevention & Hardening

Reduce the chance of this recurring on Debian 12:

• Enable scheduled security updates via unattended-upgrades:

  sudo apt install -y unattended-upgrades apt-listchanges
  sudo dpkg-reconfigure -plow unattended-upgrades
  # /etc/apt/apt.conf.d/50unattended-upgrades:
  Unattended-Upgrade::Origins-Pattern { "origin=Debian,codename=${distro_codename},label=Debian-Security"; };

• Install needrestart so services restart automatically after library upgrades:

  sudo apt install -y needrestart
  # /etc/needrestart/needrestart.conf -> $nrconf{restart} = 'a';

• Subscribe to debian-security-announce and watch security-tracker.debian.org.

• Mirror locally for controlled rollouts:

  sudo apt install -y apt-mirror
  # /etc/apt/mirror.list:
  deb http://deb.debian.org/debian bookworm main contrib non-free
  deb http://security.debian.org/debian-security bookworm-security main contrib non-free
  sudo apt-mirror

• Monitor file integrity with debsums and AIDE:

  sudo apt install -y debsums aide
  sudo debsums -ca           # report only changed conffile-less files
  sudo aideinit && sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
  sudo aide --check

• Apply CIS Debian Linux Benchmark hardening and review auditd rules in /etc/audit/rules.d/.

Related Errors & Cross-Refs

Issues that commonly surface alongside libcatalyst-authentication-credential-http-perl — vulnerability — patch and remediation guide: apt lock contention, broken dpkg state, systemd ordering cycles, AppArmor denials, and firewall rule drift. Useful triage:

sudo dpkg --configure -a
sudo apt --fix-broken install
systemd-analyze critical-chain
sudo journalctl -k | grep -i apparmor | tail
cat /proc/sys/kernel/tainted

View all debian-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Primary reference: Debian Security Tracker. Manual pages useful on Debian 12:

man apt
man apt-get
man apt-mark
man dpkg
man systemctl
man journalctl
man nft
man apparmor
man unattended-upgrades

Other resources: The Debian Administrator’s Handbook, Debian Security FAQ, Debian Security Tracker, and per-package notes in /usr/share/doc/libcatalyst-authentication-credential-http-perl/ for components implicated in libcatalyst-authentication-credential-http-perl — vulnerability — patch and remediation guide.