CVE-2025-40923

Name	CVE-2025-40923
Description	Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1109405

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libplack-middleware-session-perl (PTS)	bullseye	0.33-1	vulnerable
	bookworm	0.33-2	vulnerable
	trixie, sid	0.34-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libplack-middleware-session-perl	source	(unstable)	(unfixed)			1109405

Notes

[bookworm] - libplack-middleware-session-perl <no-dsa> (Minor issue)
[bullseye] - libplack-middleware-session-perl <postponed> (Minor issue, weak entropy for session ID)
https://lists.security.metacpan.org/cve-announce/msg/31223483/
https://github.com/plack/Plack-Middleware-Session/pull/52
https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be (0.35)