Title: JJNAPIORK, Description: Las versiones de PAGI::Middleware::Session::Store::Cookie hasta la 0.001003 para Perl generan bytes aleatorios de forma insegura.

PAGI::Middleware::Session::Store::Cookie intenta leer bytes directamente del dispositivo /dev/urandom. Si eso falla (por ejemplo, en sistemas sin el dispositivo, como Windows), entonces emitirá una advertencia que recomienda al usuario instalar Crypt::URandom, y luego devolverá una cadena de bytes aleatorios generados por la función 'rand' incorporada, lo cual no es adecuado para aplicaciones criptográficas.

Este módulo no utiliza el módulo Crypt::URandom, e instalarlo no solucionará el problema.

Los bytes aleatorios se utilizan para generar un vector de inicialización (IV) para cifrar la cookie.

Un IV predecible puede facilitar a los usuarios malintencionados descifrar y manipular los datos de la sesión que se almacenan en la cookie.

{"timestamp":"2026-04-01T14:40:20.356872Z","id":"CVE-2026-5087","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"JJNAPIORK","product":"PAGI::Middleware::Session::Store::Cookie","defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"PAGI-Middleware-Session-Store-Cookie","programFiles":["lib/PAGI/Middleware/Session/Store/Cookie.pm"],"programRoutines":[{"name":"PAGI::Middleware::Session::Store::Cookie::_random_bytes"}],"repo":"https://github.com/jjn1056/PAGI-Middleware-Session-Store-Cookie","versions":[{"version":"0","lessThanOrEqual":"0.001003","versionType":"custom","status":"affected"}]}]

OR
          *cpe:2.3:a:jjnapiork:pagi::middleware::session::store::cookie:*:*:*:*:*:perl:*:* versions up to (including) 0.001003

CPANSec: https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001003/source/lib/PAGI/Middleware/Session/Store/Cookie.pm#L156-173 Types: Broken Link

CPANSec: https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001004/changes Types: Release Notes

CVE: http://www.openwall.com/lists/oss-security/2026/03/31/10 Types: Mailing List, Third Party Advisory

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

http://www.openwall.com/lists/oss-security/2026/03/31/10

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.

PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on systems without the device, such as Windows), then it will emit a warning that recommends the user install Crypt::URandom, and then return a string of random bytes generated by the built-in rand function, which is unsuitable for cryptographic applications.

This modules does not use the Crypt::URandom module, and installing it will not fix the problem.

The random bytes are used for generating an initialisation vector (IV) to encrypt the cookie.

A predictable IV may make it easier for malicious users to decrypt and tamper with the session data that is stored in the cookie.

CWE-338

CWE-1204

https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001003/source/lib/PAGI/Middleware/Session/Store/Cookie.pm#L156-173

https://metacpan.org/release/JJNAPIORK/PAGI-Middleware-Session-Store-Cookie-0.001004/changes