CVE-2024-58135: Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default
SRI · Mojolicious
Vendor fix available · Affected: SRI Mojolicious · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 47% of scored CVEs
DescriptionCVE.org
Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX. Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- SRI · Mojoliciousfrom 7.28 up to and including 9.45
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Published
- May 2025
CoverageNo articles yet
No CyberSIXT article names CVE-2024-58135 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.
References
- NVD entrynvd.nist.gov
- CVE recordcve.org
- Weakness CWE-338cwe.mitre.org
- Release notesmetacpan.org
- Patchgithub.com
- Patchgithub.com
- perldoc.perl.org/functions/randperldoc.perl.org
- metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pmetacpan.org
- metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojoliciousmetacpan.org
- Issue trackergithub.com
- metacpan.org/release/SRI/Mojolicious-7.28/source/lib/Mojoliciousmetacpan.org
- Technical descriptionsecurity.metacpan.org
- Exploitgithub.com
- Mailing listlists.debian.org
- Mailing listlists.debian.org
1 more reference is in the CVE record.