[<prev] [next>] [day] [month] [year] [list]
Message-ID: <b0630336-a930-46ae-a7aa-3fbcaf3dbdc0@cpan.org>
Date: Thu, 5 Mar 2026 08:57:27 +0000
From: Robert Rothenberg <rrwo@...n.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-40926: Plack::Middleware::Session::Simple versions through
0.04 for Perl generates session ids insecurely
========================================================================
CVE-2025-40926 CPAN Security Group
========================================================================
CVE ID: CVE-2025-40926
Distribution: Plack-Middleware-Session-Simple
Versions: through 0.04
MetaCPAN: https://metacpan.org/dist/Plack-Middleware-Session-Simple
VCS Repo: https://github.com/kazeburo/Plack-Middleware-Session-Simple
Plack::Middleware::Session::Simple versions through 0.04 for Perl
generates session ids insecurely
Description
-----------
Plack::Middleware::Session::Simple versions through 0.04 for Perl
generates session ids insecurely.
The default session id generator returns a SHA-1 hash seeded with the
built-in rand function, the epoch time, and the PID. The PID will come
from a small set of numbers, and the epoch time may be guessed, if it
is not leaked from the HTTP Date header. The built-in rand function is
unsuitable for cryptographic usage.
Predicable session ids could allow an attacker to gain access to
systems.
Plack::Middleware::Session::Simple is intended to be compatible with
Plack::Middleware::Session, which had a similar security issue
CVE-2025-40923.
Problem types
-------------
- CWE-340 Generation of Predictable Numbers or Identifiers
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Workarounds
-----------
Users are advised to change the sid_generator attribute of
Plack::Middleware::Session::Simple to a function that returns a
securely generated session id based on a secure source of entropy from
the system.
Users may consider using Plack::Middleware::Session version 0.35 or
later.
References
----------
https://metacpan.org/release/KAZEBURO/Plack-Middleware-Session-Simple-0.04/source/lib/Plack/Middleware/Session/Simple.pm#L43
https://github.com/kazeburo/Plack-Middleware-Session-Simple/pull/4
https://github.com/kazeburo/Plack-Middleware-Session-Simple/commit/760bb358b8f53e52cf415888a4ac858fd99bb24e.patch
https://www.cve.org/CVERecord?id=CVE-2025-40923
https://security.metacpan.org/docs/guides/random-data-for-security.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
