[<prev] [day] [month] [year] [list]
Message-ID: <fb84b191-9a86-400b-b4a0-5ec9656b05a5@cpan.org>
Date: Fri, 27 Feb 2026 20:22:08 +0000
From: Robert Rothenberg <rrwo@...n.org>
To: oss-security@...ts.openwall.com
Subject: Fwd: CVE-2018-25160: HTTP::Session2 versions through 1.09 for Perl
does not validate the format of user provided session ids, enabling code
injection or other impact depending on session backend
========================================================================
CVE-2018-25160 CPAN Security Group
========================================================================
CVE ID: CVE-2018-25160
Distribution: HTTP-Session2
Versions: through 1.09
MetaCPAN: https://metacpan.org/dist/HTTP-Session2
VCS Repo: https://github.com/tokuhirom/HTTP-Session2
HTTP::Session2 versions through 1.09 for Perl does not validate the
format of user provided session ids, enabling code injection or other
impact depending on session backend
Description
-----------
HTTP::Session2 versions through 1.09 for Perl does not validate the
format of user provided session ids, enabling code injection or other
impact depending on session backend.
For example, if an application uses memcached for session storage, then
it may be possible for a remote attacker to inject memcached commands
in the session id value.
Problem types
-------------
- CWE-20 Improper Input Validation
Workarounds
-----------
Upgrade to version 1.10 or later.
Use a session storage module that offers protection against command
injections, such as Cache::Memcached::Fast::Safe.
Solutions
---------
HTTP::Session2 has been deprecated since version 1.11, users are
recommended to migrate to a different solution.
References
----------
https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes
https://metacpan.org/pod/Cache::Memcached::Fast::Safe
Timeline
--------
- 2018-01-26: version 1.10 HTTP::Session2 released with fix.
- 2026-02-24: version 1.11 HTTP::Session2 deprecated.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
