https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 18:02:26 +0000 https://vulnerability.circl.lu/vuln/cve-2024-58135 <p><strong>Affected:</strong> SRI Mojolicious</p> <p>Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via &#34;mojo generate app&#34; by default.</p> <p>When creating a default app skeleton with the &#34;mojo generate app&#34; tool, a weak secret is written to the application&#39;s configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application&#39;s sessions. This may allow an attacker to brute force the application&#39;s session keys.</p> <p>Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX.</p> <p>Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.</p> <p><strong>Affected:</strong> SRI Mojolicious</p> <p>Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via &#34;mojo generate app&#34; by default.</p> <p>When creating a default app skeleton with the &#34;mojo generate app&#34; tool, a weak secret is written to the application&#39;s configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application&#39;s sessions. This may allow an attacker to brute force the application&#39;s session keys.</p> <p>Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX.</p> <p>Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.</p> https://vulnerability.circl.lu/vuln/cve-2024-58135