CVE-2025-40924
Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely
概要
Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely.
The session id is generated from a (usually SHA-1) hash of a simple counter, the epoch time, the built-in rand function, the PID and the current Catalyst context. This information is of low entropy. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.
Predicable session ids could allow an attacker to gain access to systems.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2025-40924 libcatalyst-plugin-session-perl
- Ubuntu UBUNTU-CVE-2025-40924 libcatalyst-plugin-session-perl
参照URL
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- report github.com
- web cpan.org
- web metacpan.org