/ 
CGI-Session-4.00_06
Security Advisories (3)
CVE-2006-1279 (2006-03-19)

CGI::Session 4.03-1 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by (1) Driver::File, (2) Driver::db_file, and possibly (3) Driver::sqlite.

CPANSA-CGI-Session-2006-01 (2006-04-06)

possible SQL injection attack

CVE-2026-56016 (2026-07-01)

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl's rand() is unsuitable for security purposes because it is predictable and reversible. An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.

Changes for version 4.00_06

  • FIX (?): a test script was failing on Win32
  • FIX: inaccurate error reporting in load()

Changes for version 4.00_05

  • FIX: case insesitivity was not enforced properly in CGI::Session::parse_dsn()

Changes for version 4.00_04

  • FIX: Minor fix in tests suits and error-checking routines of serializers and id-generators

Changes for version 4.00_03

  • NEW: CGI::Session::find() introduced
  • NEW: traverse() introduced into drivers to support CGI::Session::find()
  • DOCS: More complete driver specs documented

Changes for version 4.00_02

  • FIX: race conditions in Driver/file.pm pointed out by Martin Bartosch

Changes for version 4.00_01

  • NEW: load() - constructor method to prevent unnecessary session creations
  • NEW: is_expired() - method to intercept expired sessions
  • NEW: is_empty() - to intercept requests for unexisting sessions
  • NEW: more optimized source code
  • NEW: updated and improved driver specs
  • NEW: standard testing framework
  • NEW: 'sqlite' driver

Modules

CGI::Session
persistent session data in CGI applications
CGI::Session::Driver
CGI::Session driver specifications
CGI::Session::Driver::DBI
Base class for native DBI-related CGI::Session drivers
CGI::Session::Driver::db_file
CGI::Session driver for BerkeleyDB using DB_File
CGI::Session::Driver::file
Default CGI::Session driver
CGI::Session::Driver::mysql
CGI::Session driver for MySQL database
CGI::Session::Driver::postgresql
PostgreSQL driver for CGI::Session
CGI::Session::Driver::sqlite
CGI::Session driver for SQLite
CGI::Session::ErrorHandler
error handling routines for CGI::Session
CGI::Session::ID::incr
CGI::Session ID driver
CGI::Session::ID::md5
default CGI::Session ID generator
CGI::Session::ID::static
CGI::Session ID Driver for generating static IDs
CGI::Session::Serialize::default
Default CGI::Session serializer
CGI::Session::Serialize::freezethaw
serializer for CGI::Session
CGI::Session::Serialize::storable
Serializer for CGI::Session
CGI::Session::Tutorial
Extended CGI::Session manual

Provides

CGI::Session::Test::Default
in Session/Test/Default.pm

Examples

Other files