UBUNTU-CVE-2026-56016

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-56016

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56016.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-56016

Upstream

CVE-2026-56016

Published

2026-07-01T08:16:00Z

Modified

2026-07-02T18:03:22.561290635Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl's rand() is unsuitable for security purposes because it is predictable and reversible. An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.

References

Affected packages

Ubuntu:16.04:LTS

libcgi-session-perl

Package

Name: libcgi-session-perl
Purl: pkg:deb/ubuntu/libcgi-session-perl?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.48-2

4.48-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libcgi-session-perl",
            "binary_version": "4.48-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56016.json"

Ubuntu:18.04:LTS

libcgi-session-perl

Package

Name: libcgi-session-perl
Purl: pkg:deb/ubuntu/libcgi-session-perl?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.48-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libcgi-session-perl",
            "binary_version": "4.48-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56016.json"

Ubuntu:20.04:LTS

libcgi-session-perl

Package

Name: libcgi-session-perl
Purl: pkg:deb/ubuntu/libcgi-session-perl?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.48-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libcgi-session-perl",
            "binary_version": "4.48-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56016.json"

Ubuntu:22.04:LTS

libcgi-session-perl

Package

Name: libcgi-session-perl
Purl: pkg:deb/ubuntu/libcgi-session-perl?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.48-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libcgi-session-perl",
            "binary_version": "4.48-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56016.json"

Ubuntu:24.04:LTS

libcgi-session-perl

Package

Name: libcgi-session-perl
Purl: pkg:deb/ubuntu/libcgi-session-perl?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.48-4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libcgi-session-perl",
            "binary_version": "4.48-4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56016.json"

Ubuntu:25.10

libcgi-session-perl

Package

Name: libcgi-session-perl
Purl: pkg:deb/ubuntu/libcgi-session-perl?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.48-4build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libcgi-session-perl",
            "binary_version": "4.48-4build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56016.json"

Ubuntu:26.04:LTS

libcgi-session-perl

Package

Name: libcgi-session-perl
Purl: pkg:deb/ubuntu/libcgi-session-perl?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.48-4build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libcgi-session-perl",
            "binary_version": "4.48-4build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56016.json"