| Name | CVE-2025-40931 |
| Description | Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1130891 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| libapache-session-perl (PTS) | bullseye | 1.94-1 | vulnerable |
| forky, sid, bookworm, trixie | 1.94-2 | vulnerable |
The information below is based on the following data on fixed versions.
Notes
[trixie] - libapache-session-perl <postponed> (Minor issue, revisit when fixed upstream)
[bookworm] - libapache-session-perl <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - libapache-session-perl <postponed> (Minor issue; can be fixed in next update)
https://lists.security.metacpan.org/cve-announce/msg/37639294/