[<prev] [next>] [day] [month] [year] [list]
Message-ID: <1f65be16-a94e-400f-a93e-4c84aeb8613d@cpansec.org>
Date: Sat, 28 Mar 2026 18:57:51 +0000
From: Robert Rothenberg <rrwo@...nsec.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-3256: HTTP::Session versions through 0.53 for Perl defaults
to using insecurely generated session ids
========================================================================
CVE-2026-3256 CPAN Security Group
========================================================================
CVE ID: CVE-2026-3256
Distribution: http-session
Versions: through 0.53
MetaCPAN: https://metacpan.org/dist/http-session
VCS Repo: https://github.com/tokuhirom/http-session
HTTP::Session versions through 0.53 for Perl defaults to using
insecurely generated session ids
Description
-----------
HTTP::Session versions through 0.53 for Perl defaults to using
insecurely generated session ids.
HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate
session ids using a SHA-1 hash seeded with the built-in rand function,
the high resolution epoch time, and the PID. The PID will come from a
small set of numbers, and the epoch time may be guessed, if it is not
leaked from the HTTP Date header. The built-in rand function is
unsuitable for cryptographic usage.
The distribution includes HTTP::session::ID::MD5 which contains a
similar flaw, but uses the MD5 hash instead.
Problem types
-------------
- CWE-340 Generation of Predictable Numbers or Identifiers
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Workarounds
-----------
Users on systems with a /dev/urandom device should configure the module
to use HTTP::Session::ID::Urandom.
Users on systems without a /dev/urandom (such as Windows) device will
need to create custom ID modules that make use of module such as
Crypt::SysRandom or Crypt::URandom.
References
----------
https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/SHA1.pm
https://metacpan.org/release/KTAT/http-session-0.53/source/lib/HTTP/Session/ID/MD5.pm
https://security.metacpan.org/docs/guides/random-data-for-security.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
