CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().

The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.

An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.

Üreticinin çözüm notu (İngilizce)

Upgrade to CallBackery 0.62.0 or later.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• metacpan.org/release/OETIKER/CallBackery-0.62.0/changes Diğer

Kayıt geçmişi

1. 6 Kas 2026 20:00CVSS puanı değişti: – → 7.5
2. 30 Eki 2026 16:13Yayımlandı

İlgili açıklar

• 5,3 CVE-2026-118987CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
• 5,5 CVE-2026-118990CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup
• 7,5 CVE-2026-118991CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
• 8,4 CVE-2026-118992CallBackery (Perl) yapılandırma yedeği geri yüklemede işletim sistemi komutu çalıştırma
• 7,5 CVE-2026-118993CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI
• 9,8 CVE-2026-118994CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name