https://bugzilla.redhat.com/show_bug.cgi?id=2509105
Bug ID: 2509105
Summary: CVE-2026-13577 perl-Dancer2: Dancer2: Predictable
session IDs allow system access [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["d1449e56-3b9c-42f6-aa00-ca0e5cc3add7"]}
Component: perl-Dancer2
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected]
Blocks: 2502710
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Dancer2 versions through 2.1.0 for Perl generate insecure session ids when
CSPRNG modules are unavailable.
Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a
built-in rand-derived session id when both Math::Random::ISAAC::XS and
Crypt::URandom are unavailable.
The fallback session id is generated from a SHA-1 hash of a call to the
built-in rand function, the absolute path of the
Dancer2::Core::Role::SessionFactory module, an internal counter, the process
id, the module instance memory address, and a shuffled string of characters
(using the List::Util::shuffle function, which also uses the built-in rand
function).
These are all low-entropy and easily guessed sources.
The built-in rand() function is seeded with 32-bits and considered unsuitable
for security applications.
Predictable session ids could allow an attacker to gain access to systems.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2509105
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202509105%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
