========================================================================
CVE-2018-25160                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2018-25160
   Distribution:  HTTP-Session2
       Versions:  through 1.09

       MetaCPAN:  https://metacpan.org/dist/HTTP-Session2
       VCS Repo:  https://github.com/tokuhirom/HTTP-Session2

HTTP::Session2 versions through 1.09 for Perl does not validate the
format of user provided session ids, enabling code injection or other
impact depending on session backend

Description
-----------
HTTP::Session2 versions through 1.09 for Perl does not validate the
format of user provided session ids, enabling code injection or other
impact depending on session backend.

For example, if an application uses memcached for session storage, then
it may be possible for a remote attacker to inject memcached commands
in the session id value.

Problem types
-------------
- CWE-20 Improper Input Validation

Workarounds
-----------
Upgrade to version 1.10 or later.

Use a session storage module that offers protection against command
injections, such as Cache::Memcached::Fast::Safe.

Solutions
---------
HTTP::Session2 has been deprecated since version 1.11, users are
recommended to migrate to a different solution.

References
----------
https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes
https://metacpan.org/pod/Cache::Memcached::Fast::Safe

Timeline
--------
- 2018-01-26: version 1.10 HTTP::Session2 released with fix.
- 2026-02-24: version 1.11 HTTP::Session2 deprecated.