CVE-2026-118986: слаба криптография

Описание

Оригинално описание

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline. An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.

Засегнати продукти

• : преди 0.62.0

Вид слабост

• CWE-338 Използване на криптографски слаб PRNG

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-118986
• https://nvd.nist.gov/vuln/detail/CVE-2026-118986
• https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes