CVE-2024-58135

Name	CVE-2024-58135
Description	Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets. When creating a default app with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1104633

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libmojolicious-perl (PTS)	bullseye	8.71+dfsg-1	vulnerable
	bookworm	9.31+dfsg-1	vulnerable
	sid, trixie	9.39+dfsg-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libmojolicious-perl	source	(unstable)	(unfixed)			1104633

https://lists.security.metacpan.org/cve-announce/msg/29241187/
https://github.com/mojolicious/mojo/pull/2200