Vulnerability-Lookup

ubuntu-cve-2024-58135

Vulnerability from osv_ubuntu

Published

2025-05-03 11:15

Modified

2026-07-22 05:50

Summary

Details

Mojolicious versions from 7.28 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-58135	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-58135	REPORT
	https://lists.security.metacpan.org/cve-announce/…	REPORT
	https://github.com/mojolicious/mojo/pull/2200	REPORT
	https://github.com/hashcat/hashcat/pull/4090	REPORT
	https://metacpan.org/release/SRI/Mojolicious-7.28…	REPORT
	https://metacpan.org/release/SRI/Mojolicious-9.38…	REPORT
	https://metacpan.org/release/SRI/Mojolicious-9.39…	REPORT
	https://perldoc.perl.org/functions/rand	REPORT
	https://security.metacpan.org/docs/guides/random-…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmojolicious-perl",
            "binary_version": "6.15+dfsg-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libmojolicious-perl",
        "purl": "pkg:deb/ubuntu/libmojolicious-perl@6.15+dfsg-1ubuntu1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.15+dfsg-1",
        "6.15+dfsg-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmojolicious-perl",
            "binary_version": "7.59+dfsg-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libmojolicious-perl",
        "purl": "pkg:deb/ubuntu/libmojolicious-perl@7.59+dfsg-1ubuntu1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.39+dfsg-1ubuntu1",
        "7.43+dfsg-1ubuntu1",
        "7.57+dfsg-1ubuntu1",
        "7.59+dfsg-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmojolicious-perl",
            "binary_version": "8.33+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libmojolicious-perl",
        "purl": "pkg:deb/ubuntu/libmojolicious-perl@8.33+dfsg-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.22+dfsg-1",
        "8.23+dfsg-1",
        "8.26+dfsg-1",
        "8.27+dfsg-1",
        "8.32+dfsg-1",
        "8.33+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmojolicious-perl",
            "binary_version": "9.22+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libmojolicious-perl",
        "purl": "pkg:deb/ubuntu/libmojolicious-perl@9.22+dfsg-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.71+dfsg-1",
        "9.22+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmojolicious-perl",
            "binary_version": "9.35+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "libmojolicious-perl",
        "purl": "pkg:deb/ubuntu/libmojolicious-perl@9.35+dfsg-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.33+dfsg-1",
        "9.35+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmojolicious-perl",
            "binary_version": "9.39+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "libmojolicious-perl",
        "purl": "pkg:deb/ubuntu/libmojolicious-perl@9.39+dfsg-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.39+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmojolicious-perl",
            "binary_version": "9.42+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libmojolicious-perl",
        "purl": "pkg:deb/ubuntu/libmojolicious-perl@9.42+dfsg-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.39+dfsg-1",
        "9.42+dfsg-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Mojolicious versions from 7.28 for Perl will generate weak HMAC session cookie secrets via \"mojo generate app\" by default When creating a default app skeleton with the \"mojo generate app\" tool, a weak secret is written to the application\u0027s configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application\u0027s sessions. This may allow an attacker to brute force the application\u0027s session keys.",
  "id": "UBUNTU-CVE-2024-58135",
  "modified": "2026-07-22T05:50:16Z",
  "published": "2025-05-03T11:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-58135"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58135"
    },
    {
      "type": "REPORT",
      "url": "https://lists.security.metacpan.org/cve-announce/msg/29241187/"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/mojolicious/mojo/pull/2200"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/hashcat/hashcat/pull/4090"
    },
    {
      "type": "REPORT",
      "url": "https://metacpan.org/release/SRI/Mojolicious-7.28/source/lib/Mojolicious/Command/generate/app.pm#L220"
    },
    {
      "type": "REPORT",
      "url": "https://metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojolicious/Command/Author/generate/app.pm#L202"
    },
    {
      "type": "REPORT",
      "url": "https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pm#L181"
    },
    {
      "type": "REPORT",
      "url": "https://perldoc.perl.org/functions/rand"
    },
    {
      "type": "REPORT",
      "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-58135"
  ]
}

CVE-2024-58135 (GCVE-0-2024-58135)

Vulnerability from cvelistv5 – Published: 2025-05-03 10:16 – Updated: 2026-06-05 12:37

Title

Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default

Summary

Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX. Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Assigner

CPANSec

References

13 references

URL	Tags
https://perldoc.perl.org/functions/rand	related
https://metacpan.org/release/SRI/Mojolicious-9.39…	related
https://metacpan.org/release/SRI/Mojolicious-9.38…	related
https://github.com/mojolicious/mojo/pull/2200	issue-tracking
https://metacpan.org/release/SRI/Mojolicious-7.28…	related
https://security.metacpan.org/docs/guides/random-…	technical-description
https://github.com/hashcat/hashcat/pull/4090	exploit
https://lists.debian.org/debian-perl/2025/05/msg0…	mailing-list
https://lists.debian.org/debian-perl/2025/05/msg0…	mailing-list
https://lists.debian.org/debian-perl/2025/05/msg0…	mailing-list
https://metacpan.org/release/SRI/Mojolicious-9.46…	release-notes
https://github.com/mojolicious/mojo/commit/fb3733…	patch
https://github.com/mojolicious/mojo/commit/789cfa…	patch

Impacted products

1 product

Vendor	Product	Version
SRI	Mojolicious	Affected: 7.28 , ≤ 9.45 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-58135",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-05T17:58:51.652027Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-338",
                "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T19:06:35.967Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Mojolicious",
          "product": "Mojolicious",
          "programFiles": [
            "lib/Mojolicious/Command/Author/generate/app.pm",
            "lib/Mojo/Util.pm",
            "lib/Mojolicious/Command/generate/app.pm"
          ],
          "programRoutines": [
            {
              "name": "Mojolicious::Command::Author::generate::app::run()"
            },
            {
              "name": "Mojo::Util::generate_secret()"
            }
          ],
          "repo": "https://github.com/mojolicious/mojo",
          "vendor": "SRI",
          "versions": [
            {
              "lessThanOrEqual": "9.45",
              "status": "affected",
              "version": "7.28",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via \"mojo generate app\" by default.\n\nWhen creating a default app skeleton with the \"mojo generate app\" tool, a weak secret is written to the application\u0027s configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application\u0027s sessions. This may allow an attacker to brute force the application\u0027s session keys.\n\nRelease 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX.\n\nUsers should be aware that the update does not replace previously generated weak secrets.  A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-338",
              "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T12:37:53.344Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "related"
          ],
          "url": "https://perldoc.perl.org/functions/rand"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pm#L181"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojolicious/Command/Author/generate/app.pm#L202"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/mojolicious/mojo/pull/2200"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://metacpan.org/release/SRI/Mojolicious-7.28/source/lib/Mojolicious/Command/generate/app.pm#L220"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/hashcat/hashcat/pull/4090"
        },
        {
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-perl/2025/05/msg00016.html"
        },
        {
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-perl/2025/05/msg00017.html"
        },
        {
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-perl/2025/05/msg00018.html"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/SRI/Mojolicious-9.46/source/Changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mojolicious/mojo/commit/fb3733f92cc8a3344e6d615b3c7dac9d538eeab0.patch"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mojolicious/mojo/commit/789cfa43f9118852b38cbd1fd0a2596bcb9821ea.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to version 9.46 and replace previously generated secrets."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via \"mojo generate app\" by default",
      "workarounds": [
        {
          "lang": "en",
          "value": "Ensure that your secret, stored in the application\u0027s configuration file, is at least 128 bit of cryptographically secure random data. For example, to generate a 256 bit secret, one could use the output generated by the \"openssl rand -base64 32\" command."
        },
        {
          "lang": "en",
          "value": "As of version 9.39 of Mojolicious, if the optional CryptX distribution version 0.080 or later is available in the include path before calling the \"mojo generate app\" tool, then a secure 1024 bit long secret will be generated."
        }
      ],
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2024-58135",
    "datePublished": "2025-05-03T10:16:10.636Z",
    "dateReserved": "2025-04-07T16:06:37.226Z",
    "dateUpdated": "2026-06-05T12:37:53.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

ubuntu-cve-2024-58135

Vulnerability from osv_ubuntu

CVE-2024-58135 (GCVE-0-2024-58135)

Tags

Sightings

Nomenclature