/ 
Apache-Session-1.70_01
Security Advisories (3)
CVE-2013-10075 (2026-05-08)

Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted.

CVE-2025-40931 (2026-03-05)

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Note that the libapache-session-perl package in some Debian-based Linux distributions may be patched to use Crypt::URandom.

CVE-2026-5081 (2026-05-06)

Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the process id, the epoch time, a 16-bit counter and a thread index, with no obfuscation. The server IP is often available to the public, and if not available, can be guessed from previous session ids being issued. The process ids may also be guessed from previous session ids. The timestamp is easily guessed (and leaked in the HTTP Date response header). The purpose of mod_unique_id is to assign a unique id to requests so that events can be correlated in different logs. The id is not designed, nor is it suitable for security purposes.

Changes for version 1.70_01 - 2004-09-01

  • Casey West takes the pumpkin.
  • Complete rewrite of test suite to use Test::* modules.
  • Minor documentation tweaks.
  • Changes in 1.6:
  • Fixed file age test for clean(). The previous test was never true.
  • Applied patch to add TableName option to the DBI/MySQL store. From Corris Randall <corris@line6.net>. Tests added by jwb.
  • Applied patch from Oliver Maul <oliver.maul@ixos.de> for better Sybase support, without tests.
  • Informix support from Mike Langen <mike.langen@tamedia.ch>. Unfortunately no tests were included.
  • Changes in 1.54:
  • Added mod_uniqueid and mod_usertrack generators from Tatsuhiko Miyagawa <miyagawa@bulknews.net>
  • Fixed validate function in Flex.
  • Move to Digest::MD5 instead of MD5.
  • Changes in 1.53:
  • ?
  • Changes in 1.52:
  • Chris Winters <cwinters@intes.net> added the Sybase backing store and related modules.
  • Michael Schout <mschout@gkg.net> fixed a commit policy bug in 1.51.
  • Edward Lopez <zed@apricot.com> fixed a thinko in the POD.
  • Peter Baker <Peter@eBluegrass.com> fixed a typo in the POD.
  • Andrew Wild <andrew@eservers.com.au> fixed a typo in the POD.
  • Alan Sparks <asparks@cpd.harris.com> fixed a type in the POD.
  • Jay Lawrence <jlawrenc@infonium.com> changed the interface so that an undefined or false variable indicates a fresh session. Previously, only undefined was considered new.
  • Lupe Christoph <lupe@lupe-christoph.de> noticed that there was a buffer race condition in the file store, which is now fixed.
  • Changes in 1.51:
  • Added the Oracle backing store.
  • Changes in 1.50:
  • If you are upgrading from a previous version of Apache::Session, please note these changes:
  • The Apache::Session::DBI module is gone. It has been obsoleted by MySQL and Postgres. Please read the documentation for the module that corresponds with your database.
  • The semaphore locker is no longer used anywhere by default. If you want to turn it on, you need to hack the modules themselves, or us Apache::Session::Flex.
  • By default, all IDs are now 32-characters long. You can truncate them to the previous default of 16 characters by providing the IDLength argument when tieing your sessions. Note that you might also need to extend the datatype of the ID column in your database schema.
  • All of the modules have been refreshed. I suggest reading the documentation for the ones that you plan to use.
  • Jeffrey

Modules

Apache::Session
A persistence framework for session data
Apache::Session::DB_File
An implementation of Apache::Session
Apache::Session::File
An implementation of Apache::Session
Apache::Session::Flex
Specify everything at runtime
Apache::Session::Generate::MD5
Use MD5 to create random object IDs
Apache::Session::Generate::ModUniqueId
mod_unique_id for session ID generation
Apache::Session::Generate::ModUsertrack
mod_usertrack for session ID generation
Apache::Session::Informix
An implementation of Apache::Session
Apache::Session::Lock::File
Provides mutual exclusion using flock
Apache::Session::Lock::MySQL
Provides mutual exclusion using MySQL
Apache::Session::Lock::Null
Does not actually provides mutual exclusion
Apache::Session::Lock::Semaphore
Provides mutual exclusion through sempahores
Apache::Session::Lock::Sybase
Provides mutual exclusion using Sybase
Apache::Session::MySQL
An implementation of Apache::Session
Apache::Session::Oracle
An implementation of Apache::Session
Apache::Session::Postgres
An implementation of Apache::Session
Apache::Session::Serialize::Base64
Use Storable and MIME::Base64 to zip up persistent data
Apache::Session::Serialize::Storable
Use Storable to zip up persistent data
Apache::Session::Serialize::Sybase
Use Storable to zip up persistent data and unpack/pack to put into Sybase-compatible image field
Apache::Session::Serialize::UUEncode
Use Storable and pack() to zip up persistent data
Apache::Session::Store::DB_File
Use DB_File to store persistent objects
Apache::Session::Store::File
Store persistent data on the filesystem
Apache::Session::Store::Informix
Store persistent data in a Informix database
Apache::Session::Store::MySQL
Store persistent data in a MySQL database
Apache::Session::Store::Oracle
Store persistent data in a Oracle database
Apache::Session::Store::Postgres
Store persistent data in a Postgres database
Apache::Session::Store::Sybase
Store persistent data in a Sybase database
Apache::Session::Sybase
An implementation of Apache::Session

Provides

Apache::Session::Store::DBI
in Session/Store/DBI.pm

Examples

Other files