CVE-2024-58134
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default
Summary
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default
Original description
The description as published by the source.
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.
These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-58134 libmojolicious-perl
- Ubuntu UBUNTU-CVE-2024-58134 libmojolicious-perl
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- report github.com
- report github.com
- report github.com
- report github.com
- web cpan.org
- web metacpan.org
- web docs.mojolicious.org
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web medium.com
- web synacktiv.com