PT-2026-8387 · Unknown · Concierge::Sessions

Robert Rothenberg · Publicado 2026-02-16 · Atualizado 2026-02-17 · CVE-2026-2439

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Concierge::Sessions versions 0.8.1 through 0.8.4

Description The generate session id function within Concierge::Sessions::Base defaults to insecure methods for generating session identifiers. Specifically, it uses the uuidgen command, which may fall back to Perl's rand() function if uuidgen fails, or generate time-based UUIDs if a high-quality random number source is unavailable. Both rand() and time-based UUIDs are predictable and unsuitable for security applications. The possession of these identifiers grants access, as per RFC 9562. There is no warning when uuidgen fails, potentially leading to the silent use of the insecure rand() function.

Recommendations Upgrade to version 0.8.5 or later.

Correção

Enumeração de Fraquezas

CWE-340

CWE-338

Identificadores relacionados

CVE-2026-2439

Produtos afetados

Concierge::Sessions

Referências · 12

• https://github.com/bwva/Concierge-Sessions/commit/20bb28e92e8fba307c4ff8264701c215be65e73b · Correção
• https://twitter.com/offseq/status/2023812235424887049 · Publicação no Twitter
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Nota
• https://t.me/cveNotify/152135 · Publicação no Telegram
• https://perldoc.perl.org/5.42.0/functions/rand · Nota
• https://twitter.com/CVEnew/status/2023532141926379838 · Publicação no Twitter
• https://twitter.com/offseq/status/2023525348214747391 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-2439 · Aviso do Fabricante
• https://metacpan.org/release/BVA/Concierge-Sessions-v0.8.4/diff/BVA/Concierge-Sessions-v0.8.5#lib/Concierge/Sessions/Base.pm · Nota
• https://t.me/CVEtracker/44855 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2439 · Nota de Segurança
• https://rfc-editor.org/rfc/rfc9562.html#name-security-considerations · Nota