CVE-2026-5083

Katalog CVE

CVSS 5.3 · Medium EPSS 0,52%

Kerentanan Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) pada berov ado. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Ado::Sessions versions through 0.935 for Perl generates insecure session ids. The session id is generated from a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Note that Ado is no longer maintained, and has been removed from the CPAN index. It is still available on BackPAN.

Rincian

Terbit di NVD

8 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-340: Generation of Predictable Numbers or Identifiers

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.metacpan.org/docs/guides/random-data-for-security.html advisory pihak ketiga
• https://backpan.perl.org/authors/id/B/BE/BEROV/Ado-0.935.tar.gz product
• https://github.com/kberov/Ado/issues/112 issue tracking
• http://www.openwall.com/lists/oss-security/2026/04/08/7 mailing list