Threats tagged 'brew-get_iplayer-cve-2024-58135'

Mojolicious versions from 7.28 through 9.45 for Perl generate weak HMAC session cookie secrets by default when using the "mojo generate app" tool. This weakness arises because the secret is created using the insecure rand() function, potentially allowing attackers to brute force session keys. The issue is fixed in version 9.46, which uses high-quality randomness even without CryptX. Users must replace any previously generated weak secrets to ensure security.