The session id is generated from a (usually SHA-1) hash of a simple counter, the epoch time, the built-in rand function, the PID and the current Catalyst context. This information is of low entropy. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.
Predicable session ids could allow an attacker to gain access to systems.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| HAARG | Catalyst::Plugin::Session | unaffected |
|
No data.
No data.
No data.
Subscriptions
No data.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-21775 | Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely. The session id is generated from a (usually SHA-1) hash of a simple counter, the epoch time, the built-in rand function, the PID and the current Catalyst context. This information is of low entropy. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. |
Solution
Users are advised to upgrade to Catalyst-Plugin-Session version 0.44 or later.
Workaround
No workaround given by the vendor.
Thu, 17 Jul 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Thu, 17 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely. The session id is generated from a (usually SHA-1) hash of a simple counter, the epoch time, the built-in rand function, the PID and the current Catalyst context. This information is of low entropy. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. | |
| Title | Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely | |
| Weaknesses | CWE-338 CWE-340 |
|
| References |
|
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2025-07-17T19:53:31.346Z
Reserved: 2025-04-16T09:05:34.362Z
Link: CVE-2025-40924
Vulnrichment
Updated: 2025-07-17T19:53:03.650Z
NVD
Status : Awaiting Analysis
Published: 2025-07-17T14:15:31.227
Modified: 2025-07-17T21:15:50.197
Link: CVE-2025-40924
Redhat
No data.
OpenCVE Enrichment
No data.