CVE-2025-40923

Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

Las versiones anteriores a la 0.35 de Plack-Middleware-Session para Perl generan identificadores de sesión de forma insegura. El generador de identificadores de sesión predeterminado devuelve un hash SHA-1 con la función rand integrada, la fecha y hora y el PID. El PID se obtendrá de un pequeño conjunto de números, y la fecha y hora pueden ser adivinadas si no se filtran del encabezado HTTP Date. La función rand integrada no es adecuada para uso criptográfico. Los identificadores de sesión predecibles podrían permitir que un atacante acceda a los sistemas.