CVE-2026-3256
0.02%V4
2026-03-28
18h52 +00:00
18h52 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids
HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high resolution epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. The distribution includes HTTP::session::ID::MD5 which contains a similar flaw, but uses the MD5 hash instead.CVE 解决方案
Upgrade to version 0.54 or later.
Note that HTTP::Session as of version 0.54 is deprecated. Users should migrate their applications to alternative solutions.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Generation of Predictable Numbers or Identifiers The product uses a scheme that generates numbers or identifiers that are more predictable than required. |
||
| Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
EPSS
EPSS 是一种预测漏洞被利用可能性的评分模型。
EPSS 评分
EPSS 模型生成一个介于 0 到 1（即 0% 到 100%）之间的概率评分。评分越高，漏洞被利用的可能性越大。
EPSS 百分位
百分位用于根据 EPSS 评分对 CVE 进行排名。例如，EPSS 百分位为第 95 的 CVE，其被利用的可能性高于 95% 的其他 CVE。因此，百分位可用于比较不同 CVE 的 EPSS 评分。
参考资料
https://security.metacpan.org/docs/guides/random-data-for-security.html
Tags : technical-description
Tags : technical-description
