CVE-2025-40923

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-40923
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40923.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-40923
Downstream
Published
2025-07-16T13:15:23Z
Modified
2025-07-17T20:56:42.080112Z
Summary
[none]
Details

Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.

The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.

Predicable session ids could allow an attacker to gain access to systems.

References

Affected packages

Debian:11 / libplack-middleware-session-perl

Package

Name
libplack-middleware-session-perl
Purl
pkg:deb/debian/libplack-middleware-session-perl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.33-1
0.33-2
0.34-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / libplack-middleware-session-perl

Package

Name
libplack-middleware-session-perl
Purl
pkg:deb/debian/libplack-middleware-session-perl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.33-2
0.34-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / libplack-middleware-session-perl

Package

Name
libplack-middleware-session-perl
Purl
pkg:deb/debian/libplack-middleware-session-perl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.33-2
0.34-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/plack/plack-middleware-session

Affected ranges

Type
GIT
Repo
https://github.com/plack/plack-middleware-session
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1fbfbb355e34e7f4b3906f66cf958cedadd2b9be

Affected versions

0.*

0.09_01
0.09_02
0.09_03
0.10
0.11
0.12
0.13
0.14
0.15
0.16
0.17
0.18
0.19
0.20
0.21
0.22
0.23
0.24
0.25
0.26
0.27
0.28
0.29
0.30
0.31
0.32
0.33
0.34