CVE-2025-40931

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40931", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2025-04-16T09:05:34.363Z", "datePublished": "2026-03-05T01:41:09.588Z", "dateUpdated": "2026-04-21T02:42:43.047Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Apache-Session", "product": "Apache::Session::Generate::MD5", "programFiles": ["lib/Session/Generate/MD5.pm"], "repo": "https://github.com/chorny/Apache-Session", "vendor": "CHORNY", "versions": [{"lessThanOrEqual": "1.94", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.\n\nApache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.\n\nNote that the libapache-session-perl package in some Debian-based Linux distributions may be patched to use Crypt::URandom."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-12T17:19:38.170Z"}, "references": [{"url": "https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27"}, {"tags": ["technical-description"], "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"}, {"tags": ["issue-tracking"], "url": "https://github.com/chorny/Apache-Session/issues/4"}, {"tags": ["issue-tracking"], "url": "https://rt.cpan.org/Ticket/Display.html?id=173631"}, {"tags": ["mailing-list"], "url": "https://www.openwall.com/lists/oss-security/2019/06/15/1"}, {"tags": ["issue-tracking"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930659"}, {"tags": ["patch"], "url": "https://salsa.debian.org/perl-team/modules/packages/libapache-session-perl/-/commit/bdabd71c2f91b18526e31a9dc52b4c17b3d246b7#898a4b8b00022df1b8689910b67707f3e738d180"}, {"tags": ["issue-tracking"], "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/1633"}, {"url": "https://metacpan.org/pod/Apache::Session::Generate::Random"}], "solutions": [{"lang": "en", "value": "Consider alternate solutions like https://metacpan.org/pod/Apache::Session::Generate::Random"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2017-10-06T00:00:00.000Z", "value": "Issue created in the GitHub repository for Apache-Session identifying poor entropy."}, {"lang": "en", "time": "2019-06-15T00:00:00.000Z", "value": "Report posted to the Open Source Security mailing list."}, {"lang": "en", "time": "2019-06-17T00:00:00.000Z", "value": "Debian bug 930659 for libapache-session-perl poor source of entropy for session id generation."}, {"lang": "en", "time": "2019-06-20T00:00:00.000Z", "value": "Patch to use Crypt::URandom created by the Debian Perl Group."}, {"lang": "en", "time": "2025-09-04T00:00:00.000Z", "value": "Issue reported to CPANSec."}, {"lang": "en", "time": "2026-03-05T00:00:00.000Z", "value": "CVE disclosed by CPANSec."}], "title": "Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id", "workarounds": [{"lang": "en", "value": "Apply the patch from the Debian Perl Group that uses Crypt::URandom."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/05/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-05T11:12:52.118Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T16:38:07.301789Z", "id": "CVE-2025-40931", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T02:42:43.047Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/05/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-05T11:12:52.118Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-40931", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-05T16:38:07.301789Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T16:38:30.872Z"}}], "cna": {"title": "Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "affected": [{"repo": "https://github.com/chorny/Apache-Session", "vendor": "CHORNY", "product": "Apache::Session::Generate::MD5", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.94"}], "packageName": "Apache-Session", "programFiles": ["lib/Session/Generate/MD5.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2017-10-06T00:00:00.000Z", "value": "Issue created in the GitHub repository for Apache-Session identifying poor entropy."}, {"lang": "en", "time": "2019-06-15T00:00:00.000Z", "value": "Report posted to the Open Source Security mailing list."}, {"lang": "en", "time": "2019-06-17T00:00:00.000Z", "value": "Debian bug 930659 for libapache-session-perl poor source of entropy for session id generation."}, {"lang": "en", "time": "2019-06-20T00:00:00.000Z", "value": "Patch to use Crypt::URandom created by the Debian Perl Group."}, {"lang": "en", "time": "2025-09-04T00:00:00.000Z", "value": "Issue reported to CPANSec."}, {"lang": "en", "time": "2026-03-05T00:00:00.000Z", "value": "CVE disclosed by CPANSec."}], "solutions": [{"lang": "en", "value": "Consider alternate solutions like https://metacpan.org/pod/Apache::Session::Generate::Random"}], "references": [{"url": "https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27"}, {"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html", "tags": ["technical-description"]}, {"url": "https://github.com/chorny/Apache-Session/issues/4", "tags": ["issue-tracking"]}, {"url": "https://rt.cpan.org/Ticket/Display.html?id=173631", "tags": ["issue-tracking"]}, {"url": "https://www.openwall.com/lists/oss-security/2019/06/15/1", "tags": ["mailing-list"]}, {"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930659", "tags": ["issue-tracking"]}, {"url": "https://salsa.debian.org/perl-team/modules/packages/libapache-session-perl/-/commit/bdabd71c2f91b18526e31a9dc52b4c17b3d246b7#898a4b8b00022df1b8689910b67707f3e738d180", "tags": ["patch"]}, {"url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/1633", "tags": ["issue-tracking"]}, {"url": "https://metacpan.org/pod/Apache::Session::Generate::Random"}], "workarounds": [{"lang": "en", "value": "Apply the patch from the Debian Perl Group that uses Crypt::URandom."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.\n\nApache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.\n\nNote that the libapache-session-perl package in some Debian-based Linux distributions may be patched to use Crypt::URandom."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-12T17:19:38.170Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40931", "state": "PUBLISHED", "dateUpdated": "2026-04-21T02:42:43.047Z", "dateReserved": "2025-04-16T09:05:34.363Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-03-05T01:41:09.588Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Apache-Session", "product": "Apache::Session::Generate::MD5", "programFiles": ["lib/Session/Generate/MD5.pm"], "repo": "https://github.com/chorny/Apache-Session", "vendor": "CHORNY", "versions": [{"lessThanOrEqual": "1.94", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:chorny:apache\\:\\:session\\:\\:generate\\:\\:md5:*:*:*:*:*:perl:*:*", "matchCriteriaId": "D04C726E-3C53-423A-8F6D-C2DC97BD228F", "versionEndIncluding": "1.94", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.\n\nApache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.\n\nNote that the libapache-session-perl package in some Debian-based Linux distributions may be patched to use Crypt::URandom."}, {"lang": "es", "value": "Las versiones de Apache::Session::Generate::MD5 hasta la 1.94 para Perl crean un ID de sesi\u00f3n inseguro.\n\nApache::Session::Generate::MD5 genera IDs de sesi\u00f3n de forma insegura. El generador de ID de sesi\u00f3n predeterminado devuelve un hash MD5 inicializado con la funci\u00f3n rand() incorporada, el tiempo de \u00e9poca y el PID. El PID provendr\u00e1 de un peque\u00f1o conjunto de n\u00fameros, y el tiempo de \u00e9poca puede ser adivinado, si no se filtra del encabezado HTTP Date. La funci\u00f3n rand incorporada no es adecuada para uso criptogr\u00e1fico. Los IDs de sesi\u00f3n predecibles podr\u00edan permitir a un atacante obtener acceso a los sistemas."}], "id": "CVE-2025-40931", "lastModified": "2026-06-17T09:22:19.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40931", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T16:38:07.301789Z", "version": "2.0.3"}}]}, "published": "2026-03-05T02:16:39.960", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930659"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Issue Tracking"], "url": "https://github.com/chorny/Apache-Session/issues/4"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/1633"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product"], "url": "https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5.pm#L27"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/pod/Apache::Session::Generate::Random"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://rt.cpan.org/Ticket/Display.html?id=173631"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://salsa.debian.org/perl-team/modules/packages/libapache-session-perl/-/commit/bdabd71c2f91b18526e31a9dc52b4c17b3d246b7#898a4b8b00022df1b8689910b67707f3e738d180"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://www.openwall.com/lists/oss-security/2019/06/15/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/05/3"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.94]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Apache::Session::Generate::MD5", "source": "cna", "vendor": "CHORNY"}, "product": "apache::session::generate::md5", "vendor": "chorny"}], "analysis": {"en": {"generated_at": "2026-04-20T17:25:23.367729+00:00", "value": {"mitigation_remediation": ["Upgrade to a version of Apache::Session::Generate::MD5 that incorporates the Debian patch using Crypt::URandom or replace the module with Apache::Session::Generate::Random, which provides cryptographically secure session IDs.", "Apply the Debian patch that swaps the MD5 generator for Crypt::URandom to ensure session IDs are seeded with truly random data.", "Configure the web application server to avoid leaking the HTTP Date header or otherwise limit the ability to guess the epoch time used in the session ID calculation."], "summary": {"action": "Apply Patch", "impact": "Potential session hijacking via predictable session IDs"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Apache::Session::Generate::MD5 module distributed by Chorny for Perl, for all releases up to and including version 1.94. Systems running Debian and other Linux distributions that include libapache-session-perl may contain a patched tree that uses Crypt::URandom, but unpatched deployments remain vulnerable.", "description_and_impact": "Apache::Session::Generate::MD5 produces session identifiers by hashing the output of Perl's built\u2011in rand() together with the current epoch time and a small set of process identifiers. The rand() function is not designed for cryptographic use, and the PID and epoch time can be guessed if not properly protected. This flaw aligns with CWE\u2011338 (Hard\u2011coded Cryptographic Key) and CWE\u2011340 (Use of Predictable Random Number Generation), leading to an attacker being able to predict valid session IDs and thereby impersonate legitimate users, gaining unauthorized access to web applications that rely on this module for session management.", "risk_and_exploitability": "The CVSS score of 9.1 indicates a high severity, while the EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Because the session ID generator relies on predictable inputs, an attacker can remotely attempt to guess session IDs. If session identifiers are guessed correctly, session hijacking or privilege escalation may occur. The attack vector is most likely remote over HTTP/HTTPS, though disabling exposure of the Date header could reduce the predictability of the epoch component."}}}}, "created": "2026-03-06T15:17:59.741317+00:00", "updated": "2026-04-20T17:30:12.655123+00:00", "vendors": ["chorny", "chorny$PRODUCT$apache::session::generate::md5"]}