[<prev] [next>] [day] [month] [year] [list]
Message-ID: <296f9f08-7ef9-4948-8913-ce542b2aa9f9@cpan.org>
Date: Wed, 16 Jul 2025 14:18:13 +0100
From: Robert Rothenberg <rrwo@...n.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-40923: Plack-Middleware-Session before version 0.35 for Perl
generates session ids insecurely
========================================================================
CVE-2025-40923 CPAN Security Group
========================================================================
CVE ID: CVE-2025-40923
Distribution: Plack-Middleware-Session
Versions: from 0.01 before 0.35
MetaCPAN: https://metacpan.org/dist/Plack-Middleware-Session
VCS Repo: https://github.com/plack/Plack-Middleware-Session
Plack-Middleware-Session before version 0.35 for Perl generates session
ids insecurely
Description
-----------
Plack-Middleware-Session before version 0.35 for Perl generates session
ids insecurely.
The default session id generator returns a SHA-1 hash seeded with the
built-in rand function, the epoch time, and the PID. The PID will come
from a small set of numbers, and the epoch time may be guessed, if it
is not leaked from the HTTP Date header. The built-in rand function is
unsuitable for cryptographic usage.
Predicable session ids could allow an attacker to gain access to
systems.
Problem types
-------------
- CWE-340 Generation of Predictable Numbers or Identifiers
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Workarounds
-----------
Users who are unable to upgrade are advised to change the sid_generator
attribute of Plack::Session::State to a function that returns a
securely generated session id based on a secure source of entropy from
the system.
Solutions
---------
Users are advised to upgrade to Plack-Middleware-Session v0.35 or
later.
References
----------
https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.34/source/lib/Plack/Session/State.pm#L22
https://github.com/plack/Plack-Middleware-Session/pull/52
https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be.patch
https://security.metacpan.org/docs/guides/random-data-for-security.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
