[<prev] [next>] [day] [month] [year] [list]
Message-ID: <450f03da-626a-48c3-9fac-575427db40f9@cpan.org>
Date: Thu, 5 Mar 2026 09:02:22 +0000
From: Robert Rothenberg <rrwo@...n.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-40931: Apache::Session::Generate::MD5 versions through 1.94
for Perl create insecure session id
========================================================================
CVE-2025-40931 CPAN Security Group
========================================================================
CVE ID: CVE-2025-40931
Distribution: Apache-Session
Versions: through 1.94
MetaCPAN: https://metacpan.org/dist/Apache-Session
VCS Repo: https://github.com/chorny/Apache-Session
Apache::Session::Generate::MD5 versions through 1.94 for Perl create
insecure session id
Description
-----------
Apache::Session::Generate::MD5 versions through 1.94 for Perl create
insecure session id.
Apache::Session::Generate::MD5 generates session ids insecurely. The
default session id generator returns a MD5 hash seeded with the
built-in rand() function, the epoch time, and the PID. The PID will
come from a small set of numbers, and the epoch time may be guessed, if
it is not leaked from the HTTP Date header. The built-in rand function
is unsuitable for cryptographic usage. Predicable session ids could
allow an attacker to gain access to systems.
Problem types
-------------
- CWE-340 Generation of Predictable Numbers or Identifiers
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Solutions
---------
Consider alternate solutions like
https://metacpan.org/pod/Apache::Session::Generate::Random
References
----------
https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27
https://security.metacpan.org/docs/guides/random-data-for-security.html
Credits
-------
Robert Rothenberg, finder
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
