/ 
Apache-Session-1.81
River stage two • 34 direct dependents • 52 total dependents
Security Advisories (1)
CVE-2025-40931 (2026-03-05)

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

Changes for version 1.81 - 2006-05-23

  • Don't unconditionally try to require packages in Apache::Session::Flex (Dave Rolsky).

Modules

Apache::Session
A persistence framework for session data
Apache::Session::DB_File
An implementation of Apache::Session
Apache::Session::File
An implementation of Apache::Session
Apache::Session::Flex
Specify everything at runtime
Apache::Session::Generate::MD5
Use MD5 to create random object IDs
Apache::Session::Generate::ModUniqueId
mod_unique_id for session ID generation
Apache::Session::Generate::ModUsertrack
mod_usertrack for session ID generation
Apache::Session::Informix
An implementation of Apache::Session
Apache::Session::Lock::File
Provides mutual exclusion using flock
Apache::Session::Lock::MySQL
Provides mutual exclusion using MySQL
Apache::Session::Lock::Null
Does not actually provides mutual exclusion
Apache::Session::Lock::Semaphore
Provides mutual exclusion through sempahores
Apache::Session::Lock::Sybase
Provides mutual exclusion using Sybase
Apache::Session::MySQL
An implementation of Apache::Session
Apache::Session::Oracle
An implementation of Apache::Session
Apache::Session::Postgres
An implementation of Apache::Session
Apache::Session::Serialize::Base64
Use Storable and MIME::Base64 to zip up persistent data
Apache::Session::Serialize::Storable
Use Storable to zip up persistent data
Apache::Session::Serialize::Sybase
Use Storable to zip up persistent data and unpack/pack to put into Sybase-compatible image field
Apache::Session::Serialize::UUEncode
Use Storable and pack() to zip up persistent data
Apache::Session::Store::DB_File
Use DB_File to store persistent objects
Apache::Session::Store::File
Store persistent data on the filesystem
Apache::Session::Store::Informix
Store persistent data in a Informix database
Apache::Session::Store::MySQL
Store persistent data in a MySQL database
Apache::Session::Store::Oracle
Store persistent data in a Oracle database
Apache::Session::Store::Postgres
Store persistent data in a Postgres database
Apache::Session::Store::Sybase
Store persistent data in a Sybase database
Apache::Session::Sybase
An implementation of Apache::Session

Provides

Apache::Session::Store::DBI
in Session/Store/DBI.pm

Examples

Other files