CVE-2026-119037: слаба криптография

Описание

Оригинално описание

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is. A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.

Засегнати продукти

• : преди 1.01

Вид слабост

• CWE-347 Неправилна проверка на криптографски подпис

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-119037
• https://nvd.nist.gov/vuln/detail/CVE-2026-119037
• https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes