CVE-2026-9692
2026-06-18
17h53 +00:00
17h53 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely
Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These are predictable or low-entropy sources that are unsuitable for security purposes.CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Generation of Predictable Numbers or Identifiers The product uses a scheme that generates numbers or identifiers that are more predictable than required. |
||
| Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
参考资料
https://security.metacpan.org/patches/M/Mojolicious-Plugin-SessionStore/0.05/CVE-2026-9692-r1.patch
Tags : patch
Tags : patch
https://security.metacpan.org/docs/guides/random-data-for-security.html
Tags : technical-description
Tags : technical-description
