{
  "cveId": "CVE-2024-58134",
  "url": "https://patchblox.com/security/cve/CVE-2024-58134",
  "summary": "CVE-2024-58134 is fixed in 2 products on 1 platform, first by ALAS2023-2025-985, released May 21, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "perl-Mojolicious: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2024-58135:\n\tMojolici...",
  "description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2024-58135:\n\tMojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets.\n\nWhen creating a default app with the \u0022mojo generate app\u0022 tool, a weak secret is written to the application\u0027s configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application\u0027s sessions. This may allow an attacker to brute force the application\u0027s session keys.\u002B\u002B6330\n\nCVE-2024-58134:\n\tMojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application\u0027s class name, as a HMAC session secret by default.\n\nThese predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user\u0027s session.",
  "published": "2025-05-21T19:36:00Z",
  "severity": "important",
  "epss": 0.00556,
  "epssPercentile": 0.46591,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "perl-Mojolicious",
      "release": "amzn 2023",
      "fixedVersion": "9.40-3.amzn2023.0.1",
      "fix": "ALAS2023-2025-985",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-985",
      "released": "2025-05-21T19:36:00Z"
    },
    {
      "platform": "linux",
      "product": "perl-Test-Mojo",
      "release": "amzn 2023",
      "fixedVersion": "9.40-3.amzn2023.0.1",
      "fix": "ALAS2023-2025-985",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-985",
      "released": "2025-05-21T19:36:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}