CVE-2024-58134
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default
Résumé
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.
These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-58134 libmojolicious-perl
- Ubuntu UBUNTU-CVE-2024-58134 libmojolicious-perl
Références
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- report github.com
- report github.com
- report github.com
- report github.com
- web cpan.org
- web metacpan.org
- web docs.mojolicious.org
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web medium.com
- web synacktiv.com