CVE-2024-58134
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default
概要
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.
These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2024-58134 libmojolicious-perl
- Ubuntu UBUNTU-CVE-2024-58134 libmojolicious-perl
参照URL
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- report github.com
- report github.com
- report github.com
- report github.com
- web cpan.org
- web metacpan.org
- web docs.mojolicious.org
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web medium.com
- web synacktiv.com