High
libmojolicious-perl — security advisory
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
- Products
- libmojolicious-perl
- Affected versions
- 6.15+dfsg-1, 6.15+dfsg-1ubuntu1, 7.39+dfsg-1ubuntu1, 7.43+dfsg-1ubuntu1, 7.57+dfsg-1ubuntu1, 7.59+dfsg-1ubuntu1, 8.22+dfsg-1, 8.23+dfsg-1, 8.26+dfsg-1, 8.27+dfsg-1, 8.32+dfsg-1, 8.33+dfsg-1, 8.71+dfsg-1, 9.22+dfsg-1, 9.33+dfsg-1, 9.35+dfsg-1, 9.39+dfsg-1, 9.42+dfsg-1, 9.45+dfsg-2, 9.46+dfsg-1, 9.48+dfsg-1
- Fixed versions
- Not specified
- CVEs
- CVE-2024-58134
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:23 UTC · Revision 1
Source evidence
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
osv:UBUNTU-CVE-2024-58134
libmojolicious-perl
Fixed versions: Not specified
libmojolicious-perl
Fixed versions: Not specified
libmojolicious-perl
Fixed versions: Not specified
libmojolicious-perl
Fixed versions: Not specified
libmojolicious-perl
Fixed versions: Not specified
libmojolicious-perl
Fixed versions: Not specified
libmojolicious-perl
Fixed versions: Not specified
libmojolicious-perl
Fixed versions: Not specified
Complete source record
{
"id": "de2596a7b02e9583a80b762d9b90978375ab13a04f56e4755ea8a2c21780b47a",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-58134",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2024-58134",
"summary": "Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.",
"evidence": "osv:UBUNTU-CVE-2024-58134",
"products": [
{
"name": {
"value": "libmojolicious-perl",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.15+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.15+dfsg-1ubuntu1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "libmojolicious-perl",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.39+dfsg-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "7.43+dfsg-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "7.57+dfsg-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "7.59+dfsg-1ubuntu1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "libmojolicious-perl",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.22+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.23+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.26+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.27+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.32+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.33+dfsg-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "libmojolicious-perl",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.71+dfsg-1",
"evidence": "/affected/3/versions"
},
{
"value": "9.22+dfsg-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "libmojolicious-perl",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "9.33+dfsg-1",
"evidence": "/affected/4/versions"
},
{
"value": "9.35+dfsg-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "libmojolicious-perl",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "9.39+dfsg-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "libmojolicious-perl",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "9.42+dfsg-1",
"evidence": "/affected/6/versions"
},
{
"value": "9.45+dfsg-2",
"evidence": "/affected/6/versions"
},
{
"value": "9.46+dfsg-1",
"evidence": "/affected/6/versions"
},
{
"value": "9.48+dfsg-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "libmojolicious-perl",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "9.39+dfsg-1",
"evidence": "/affected/7/versions"
},
{
"value": "9.42+dfsg-1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2024-58134",
"aliases": [
"UBUNTU-CVE-2024-58134"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmojolicious-perl",
"purl": "pkg:deb/ubuntu/libmojolicious-perl?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"6.15+dfsg-1",
"6.15+dfsg-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-58134.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmojolicious-perl",
"binary_version": "6.15+dfsg-1ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmojolicious-perl",
"purl": "pkg:deb/ubuntu/libmojolicious-perl?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"7.39+dfsg-1ubuntu1",
"7.43+dfsg-1ubuntu1",
"7.57+dfsg-1ubuntu1",
"7.59+dfsg-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-58134.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmojolicious-perl",
"binary_version": "7.59+dfsg-1ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmojolicious-perl",
"purl": "pkg:deb/ubuntu/libmojolicious-perl?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"8.22+dfsg-1",
"8.23+dfsg-1",
"8.26+dfsg-1",
"8.27+dfsg-1",
"8.32+dfsg-1",
"8.33+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-58134.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmojolicious-perl",
"binary_version": "8.33+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmojolicious-perl",
"purl": "pkg:deb/ubuntu/libmojolicious-perl?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"8.71+dfsg-1",
"9.22+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-58134.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmojolicious-perl",
"binary_version": "9.22+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmojolicious-perl",
"purl": "pkg:deb/ubuntu/libmojolicious-perl?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"9.33+dfsg-1",
"9.35+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-58134.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmojolicious-perl",
"binary_version": "9.35+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmojolicious-perl",
"purl": "pkg:deb/ubuntu/libmojolicious-perl?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"9.39+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-58134.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmojolicious-perl",
"binary_version": "9.39+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmojolicious-perl",
"purl": "pkg:deb/ubuntu/libmojolicious-perl?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"9.42+dfsg-1",
"9.45+dfsg-2",
"9.46+dfsg-1",
"9.48+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-58134.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmojolicious-perl",
"binary_version": "9.48+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libmojolicious-perl",
"purl": "pkg:deb/ubuntu/libmojolicious-perl?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"9.39+dfsg-1",
"9.42+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-58134.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libmojolicious-perl",
"binary_version": "9.42+dfsg-1"
}
]
}
}
],
"modified": "2026-10-17T12:56:46.450628394Z",
"provider": "osv",
"upstream": [
"CVE-2024-58134"
],
"references": [
"https://ubuntu.com/security/CVE-2024-58134",
"https://www.cve.org/CVERecord?id=CVE-2024-58134",
"https://lists.security.metacpan.org/cve-announce/msg/29247502/",
"https://github.com/mojolicious/mojo/pull/1791",
"https://github.com/mojolicious/mojo/pull/2200",
"https://github.com/hashcat/hashcat/pull/4090",
"https://medium.com/securing/baking-mojolicious-cookies-revisited-a-case-study-of-solving-security-problems-through-security-by-13da7c225802",
"https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojolicious.pm#L51",
"https://www.synacktiv.com/publications/baking-mojolicious-cookies"
]
},
"related_cves": [
{
"value": "CVE-2024-58134",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 356223,
"published_at": "2025-05-03T16:15:00+00:00"
}