CVE-2025-40931

The Apache::Session::Generate::MD5 Perl module (versions through 1.94 ) generates insecure session IDs. The root cause is the use of a predictable seed for an MD5 hash, consisting of the built-in rand() function (unsuitable for cryptography), the epoch time , and the PID . Attackers may guess the...