https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:08:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-319006 EUVD-2026-319006 https://cve.radiocsirt.org/vuln/euvd-2026-319006 https://cve.radiocsirt.org/vuln/fkie_cve-2026-8503 <p>Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.</p> <p>Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.</p> <p>Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.</p> <p>This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.</p> <p>Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.</p> <p>Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.</p> <p>Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.</p> <p>This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-8503 https://cve.radiocsirt.org/vuln/ghsa-2c59-fqg7-rwrx <p>Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.</p> <p>Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.</p> <p>Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.</p> <p>This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.</p> <p>Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.</p> <p>Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.</p> <p>Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.</p> <p>This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.</p> https://cve.radiocsirt.org/vuln/ghsa-2c59-fqg7-rwrx https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-8503 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libapache-session-browseable-perl, Ubuntu:18.04:LTS: libapache-session-browseable-perl, Ubuntu:20.04:LTS: libapache-session-browseable-perl, Ubuntu:22.04:LTS: libapache-session-browseable-perl, Ubuntu:24.04:LTS: libapache-session-browseable-perl, Ubuntu:25.10: libapache-session-browseable-perl, Ubuntu:26.04:LTS: libapache-session-browseable-perl</p> <p>Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems. Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module. This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libapache-session-browseable-perl, Ubuntu:18.04:LTS: libapache-session-browseable-perl, Ubuntu:20.04:LTS: libapache-session-browseable-perl, Ubuntu:22.04:LTS: libapache-session-browseable-perl, Ubuntu:24.04:LTS: libapache-session-browseable-perl, Ubuntu:25.10: libapache-session-browseable-perl, Ubuntu:26.04:LTS: libapache-session-browseable-perl</p> <p>Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems. Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module. This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-8503