[<prev] [next>] [day] [month] [year] [list]
Message-ID: <519da6569229ef855d1d412d9b61a9da@cpansec.org>
Date: Wed, 25 Mar 2026 23:06:18 -0300
From: Timothy Legge <timlegge@...nsec.org>
To: Cve Announce <cve-announce@...urity.metacpan.org>, Oss Security
<oss-security@...ts.openwall.com>
Subject: CVE-2014-125112: Plack::Middleware::Session::Cookie versions through
0.21 for Perl allows remote code execution
========================================================================
CVE-2014-125112 CPAN Security Group
========================================================================
CVE ID: CVE-2014-125112
Distribution: Plack-Middleware-Session
Versions: through 0.21
MetaCPAN: https://metacpan.org/dist/Plack-Middleware-Session
VCS Repo: https://github.com/plack/Plack-Middleware-Session
Plack::Middleware::Session::Cookie versions through 0.21 for Perl
allows remote code execution
Description
-----------
Plack::Middleware::Session::Cookie versions through 0.21 for Perl
allows remote code execution.
Plack::Middleware::Session::Cookie versions through 0.21 has a security
vulnerability where it allows an attacker to execute arbitrary code on
the server during deserialization of the cookie data, when there is no
secret used to sign the cookie.
Problem types
-------------
- CWE-565 Reliance on Cookies without Validation and Integrity Checking
Workarounds
-----------
Set the "secret" option.
Solutions
---------
Upgrade Plack::Middleware::Session to version 0.23 or later (ideally
version 0.36 or later), and set the "secret" option.
References
----------
https://gist.github.com/miyagawa/2b8764af908a0dacd43d
https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes
Timeline
--------
- 2014-08-11: Vulnerability disclosed by MIYAGAWA.
- 2014-08-11: Version 0.22 released that warns when the "secret" option
is not set.
- 2014-08-11: Version 0.23-TRIAL released that requires the "secret"
option to be set.
- 2014-09-05: Version 0.24 released. Same as 0.23 but not a trial
release.
- 2016-02-03: Version 0.26 released. Documentation improved with
SYNOPSIS giving an example of how to set the "secret" option.
- 2019-01-26: CPANSA-Plack-Middleware-Session-Cookie-2014-01 assigned
in CPAN::Audit::DB
- 2019-03-09: CPANSA-Plack-Middleware-Session-2014-01 reassigned in
CPAN::Audit::DB
- 2025-07-08: CVE-2014-125112 assigned by CPANSec.
Credits
-------
mala (@bulkneets), finder
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
