https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:29:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-331939 EUVD-2026-331939 https://cve.radiocsirt.org/vuln/euvd-2026-331939 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56016 <p>CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.</p> <p>The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl&#39;s rand() is unsuitable for security purposes because it is predictable and reversible.</p> <p>An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.</p> <p>CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.</p> <p>The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl&#39;s rand() is unsuitable for security purposes because it is predictable and reversible.</p> <p>An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56016 https://cve.radiocsirt.org/vuln/ghsa-r49c-4q8x-x33v <p>CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.</p> <p>The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl&#39;s rand() is unsuitable for security purposes because it is predictable and reversible.</p> <p>An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.</p> <p>CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.</p> <p>The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl&#39;s rand() is unsuitable for security purposes because it is predictable and reversible.</p> <p>An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.</p> https://cve.radiocsirt.org/vuln/ghsa-r49c-4q8x-x33v https://cve.radiocsirt.org/vuln/opensuse-su-2026:11168-1 <p>perl-CGI-Session-4.490.0-1.1 on GA media</p> <p>perl-CGI-Session-4.490.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11168-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56016 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libcgi-session-perl, Ubuntu:18.04:LTS: libcgi-session-perl, Ubuntu:20.04:LTS: libcgi-session-perl, Ubuntu:22.04:LTS: libcgi-session-perl, Ubuntu:24.04:LTS: libcgi-session-perl, Ubuntu:25.10: libcgi-session-perl, Ubuntu:26.04:LTS: libcgi-session-perl</p> <p>CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl&#39;s rand() is unsuitable for security purposes because it is predictable and reversible. An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libcgi-session-perl, Ubuntu:18.04:LTS: libcgi-session-perl, Ubuntu:20.04:LTS: libcgi-session-perl, Ubuntu:22.04:LTS: libcgi-session-perl, Ubuntu:24.04:LTS: libcgi-session-perl, Ubuntu:25.10: libcgi-session-perl, Ubuntu:26.04:LTS: libcgi-session-perl</p> <p>CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl&#39;s rand() is unsuitable for security purposes because it is predictable and reversible. An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56016