CVE-2025-40931

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-40931
Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Note that the libapache-session-perl package in some Debian-based Linux distributions may be patched to use Crypt::URandom.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930659
https://github.com/chorny/Apache-Session/issues/4 Issue Tracking
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/1633
https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27 Product
https://metacpan.org/pod/Apache::Session::Generate::Random
https://rt.cpan.org/Ticket/Display.html?id=173631 Third Party Advisory
https://salsa.debian.org/perl-team/modules/packages/libapache-session-perl/-/commit/bdabd71c2f91b18526e31a9dc52b4c17b3d246b7#898a4b8b00022df1b8689910b67707f3e738d180
https://security.metacpan.org/docs/guides/random-data-for-security.html Mailing List Third Party Advisory
https://www.openwall.com/lists/oss-security/2019/06/15/1
http://www.openwall.com/lists/oss-security/2026/03/05/3 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:chorny:apache\:\:session\:\:generate\:\:md5:*:*:*:*:*:perl:*:*
History

12 Apr 2026, 18:16

Type Values Removed Values Added
Summary
  • (es) Las versiones de Apache::Session::Generate::MD5 hasta la 1.94 para Perl crean un ID de sesión inseguro. Apache::Session::Generate::MD5 genera IDs de sesión de forma insegura. El generador de ID de sesión predeterminado devuelve un hash MD5 inicializado con la función rand() incorporada, el tiempo de época y el PID. El PID provendrá de un pequeño conjunto de números, y el tiempo de época puede ser adivinado, si no se filtra del encabezado HTTP Date. La función rand incorporada no es adecuada para uso criptográfico. Los IDs de sesión predecibles podrían permitir a un atacante obtener acceso a los sistemas.
Summary (en) Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. (en) Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Note that the libapache-session-perl package in some Debian-based Linux distributions may be patched to use Crypt::URandom.
References
  • () https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930659 -
  • () https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/1633 -
  • () https://metacpan.org/pod/Apache::Session::Generate::Random -
  • () https://salsa.debian.org/perl-team/modules/packages/libapache-session-perl/-/commit/bdabd71c2f91b18526e31a9dc52b4c17b3d246b7#898a4b8b00022df1b8689910b67707f3e738d180 -
  • () https://www.openwall.com/lists/oss-security/2019/06/15/1 -

09 Mar 2026, 14:41

Type Values Removed Values Added
References () https://github.com/chorny/Apache-Session/issues/4 - () https://github.com/chorny/Apache-Session/issues/4 - Issue Tracking
References () https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27 - () https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27 - Product
References () https://rt.cpan.org/Ticket/Display.html?id=173631 - () https://rt.cpan.org/Ticket/Display.html?id=173631 - Third Party Advisory
References () https://security.metacpan.org/docs/guides/random-data-for-security.html - () https://security.metacpan.org/docs/guides/random-data-for-security.html - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2026/03/05/3 - () http://www.openwall.com/lists/oss-security/2026/03/05/3 - Mailing List, Third Party Advisory
First Time Chorny apache\
Chorny
CPE cpe:2.3:a:chorny:apache\:\:session\:\:generate\:\:md5:*:*:*:*:*:perl:*:*

06 Mar 2026, 04:15

Type Values Removed Values Added
References
  • () https://github.com/chorny/Apache-Session/issues/4 -
  • () https://rt.cpan.org/Ticket/Display.html?id=173631 -

05 Mar 2026, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1

05 Mar 2026, 12:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/03/05/3 -

05 Mar 2026, 02:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-05 02:16

Updated : 2026-04-12 18:16

NVD link : CVE-2025-40931

Mitre link : CVE-2025-40931

CVE.ORG link : CVE-2025-40931

JSON object : View

Products Affected

chorny

  • apache\
CWE
CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-340

Generation of Predictable Numbers or Identifiers