CVE catalog

CVE-2025-40931

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a M

[CVE catalog]

Severity
Critical · CVSS 9.1
Published
Source
[NVD] · [CVE record]
EPSS
0.61% · Oct 25, 2026

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Note that the libapache-session-perl package in some Debian-based Linux distributions may be patched to use Crypt::URandom.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibapache-session-perlsid1.94-2vulnerable
Debianlibapache-session-perlforky1.94-2vulnerable
Debianlibapache-session-perltrixie1.94-2vulnerable
Debianlibapache-session-perlbookworm1.94-2vulnerable
Cpelibapache-session-perlNot reportedNot reportedvulnerable
Ubuntulibapache-session-perl16.041.93-2vulnerable
Ubuntulibapache-session-perl16.041.93-2ubuntu1vulnerable
Ubuntulibapache-session-perl18.041.93-2ubuntu1vulnerable
Ubuntulibapache-session-perl20.041.93-3vulnerable
Ubuntulibapache-session-perl22.041.94-1vulnerable
Ubuntulibapache-session-perl24.041.94-2vulnerable
Ubuntulibapache-session-perl25.101.94-2vulnerable
Ubuntulibapache-session-perl26.101.94-2vulnerable
Ubuntulibapache-session-perl26.041.94-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibapache-session-perlsourcesid(unfixed)not yet assignedNot reported[1130891]
Debianlibapache-session-perlsourceforky(unfixed)not yet assignedNot reported[1130891]
Debianlibapache-session-perlsourcetrixie(unfixed)not yet assignedNot reported[1130891]
Debianlibapache-session-perlsourcebookworm(unfixed)not yet assignedNot reported[1130891]

[Debian bug #1130891]

Notes

[trixie] libapache-session-perl: Minor issue, revisit when fixed upstream [bookworm] libapache-session-perl: Minor issue, revisit when fixed upstream

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libapache-session-perl]Affected
    Details (2)

    • 1.94-2 · all · bookworm

      Affected

      nvd · libapache-session-perl · debian · bookworm; nvd · libapache-session-perl · debian · 12

    • 1.94-2 · all · bookworm

      Affected

      nvd · libapache-session-perl · debian · bookworm; nvd · libapache-session-perl · debian · 12

[Debian 13 (Trixie)]

  • [libapache-session-perl]Affected
    Details (2)

    • 1.94-2 · all · trixie

      Affected

      nvd · libapache-session-perl · debian · 13

    • 1.94-2 · all · trixie

      Affected

      nvd · libapache-session-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]