PT-2025-29824 · Unknown+1 · Plack::Middleware::Session+1

Robert Rothenberg · Published 2025-07-16 · Updated 2026-03-12 · CVE-2025-40923

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Plack-Middleware-Session versions prior to 0.35

Description The default session ID generator in Plack-Middleware-Session for Perl uses a SHA-1 hash seeded with the built-in rand function, the epoch time, and the process ID (PID). The PID originates from a limited set of numbers, and the epoch time may be predictable. The rand function is not suitable for cryptographic purposes. Predictable session IDs could allow an attacker to gain unauthorized access to systems.

Recommendations Update Plack-Middleware-Session to version 0.35 or later.

Fix

Weakness Enumeration

CWE-338

CWE-340

Related Identifiers

CVE-2025-40923

Affected Products

Debian

Plack::Middleware::Session

References · 19

• https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be.patch · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-40923 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-40923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40923 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40923 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40923 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-40923 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-40923 · Vendor Advisory
• https://github.com/plack/Plack-Middleware-Session/pull/52 · Note
• https://t.me/cveNotify/155201 · Telegram Post
• https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.34/source/lib/Plack/Session/State.pm#L22 · Note
• https://t.me/cvenotify/129159 · Telegram Post
• http://openwall.com/lists/oss-security/2025/07/16/4 · Note
• https://twitter.com/CVEnew/status/1945482456905433157 · Twitter Post
• https://security.metacpan.org/docs/guides/random-data-for-security.html · Note