Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generate the client nonce (cnonce) insecurely by using an MD5 hash of predictable values including process ID, epoch time, and a non-cryptographic random function. This weak entropy in cnonce generation can undermine the security guarantees of the DIGEST_MD5 authentication mechanism.