CVE-2026-9692
2026-06-18
17h53 +00:00
17h53 +00:00
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
CVE 설명
Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely
Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These are predictable or low-entropy sources that are unsuitable for security purposes.CVE 정보
관련 약점
| 약점 이름 | 출처 | |
|---|---|---|
| Generation of Predictable Numbers or Identifiers The product uses a scheme that generates numbers or identifiers that are more predictable than required. |
||
| Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
참고 자료
https://security.metacpan.org/patches/M/Mojolicious-Plugin-SessionStore/0.05/CVE-2026-9692-r1.patch
Tags : patch
Tags : patch
https://security.metacpan.org/docs/guides/random-data-for-security.html
Tags : technical-description
Tags : technical-description
