PT-2025-29908 · Catalyst+1 · Catalyst-Plugin-Session+1

Published 2025-01-01 · Updated 2025-07-17 · CVE-2025-40924

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Catalyst::Plugin::Session versions prior to 0.44

Description The session ID generation process uses low-entropy data, including a counter, epoch time, the rand function, the process ID (PID), and the Catalyst context. The rand function is unsuitable for cryptographic purposes. Predictable session IDs could allow an attacker to gain unauthorized access to systems.

Recommendations Update to Catalyst::Plugin::Session version 0.44 or later.

Fix

Weakness Enumeration

CWE-338

CWE-340

Related Identifiers

CVE-2025-40924

Affected Products

Catalyst-Plugin-Session

Debian

References · 16

• https://github.com/perl-catalyst/Catalyst-Plugin-Session/commit/c0e2b4ab1e42ebce1008286db8c571b6ee98c22c.patch · Patch
• https://osv.dev/vulnerability/CVE-2025-40924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40924 · Security Note
• https://ubuntu.com/security/CVE-2025-40924 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-40924 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-40924 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40924 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-40924 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-40924 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/libcatalyst-plugin-session-perl · Vendor Advisory
• https://github.com/perl-catalyst/Catalyst-Plugin-Session/pull/5 · Note
• https://t.me/cvetracker/28029 · Telegram Post
• https://metacpan.org/release/HAARG/Catalyst-Plugin-Session-0.43/source/lib/Catalyst/Plugin/Session.pm#L632 · Note
• https://twitter.com/CVEnew/status/1945849861108105680 · Twitter Post
• https://t.me/cvenotify/129362 · Telegram Post