PUBLISHED
2026-03-31 16:16
MODIFIED
2026-03-31 16:16
EPSS (Prob. Exploit)
0.32%
Top 74.7%
> DESCRIPTION
PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.
PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on systems without the device, such as Windows), then it will emit a warning that recommends the user install Crypt::URandom, and then return a string of random bytes generated by the built-in rand function, which is unsuitable for cryptographic applications.
This modules does not use the Crypt::URandom module, and installing it will not fix the problem.
The random bytes are used for generating an initialisation vector (IV) to encrypt the cookie.
A predictable IV may make it easier for malicious users to decrypt and tamper with the session data that is stored in the cookie.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. | CWE-1204: Generation of Weak Initialization Vector (IV) - The product uses a cryptographic primitive that uses an Initialization
Vector (IV), but the product does not generate IVs that are
sufficiently unpredictable or unique according to the expected
cryptographic requirements for that primitive.
> GITHUB SECURITY ADVISORY
GHSA-g743-m6x3-v6wm
HIGH
linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request
AFFECTED PACKAGES:
GO / github.com/andreimarcu/linx-server
<= 2.3.8
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely
AFFECTED PACKAGES:
Unknown / Unknown
3 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
31/03/2026 16:16
Source: NVD
📊
ENRICHISSEMENT
01/04/2026 06:02
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptogra...
Total des modifications: 1
Dernière mise à jour: 7 months ago