{"id":"CVE-2013-10031","aliases":["DEBIAN-CVE-2013-10031","EUVD-2013-7289","GHSA-rvh4-4hm5-gx4x","UBUNTU-CVE-2013-10031"],"status":"published","title":"Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks","description":"Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00291,"percentile":0.21847,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1254"],"published":"2025-12-09T00:12:36Z","modified":"2026-09-01T20:03:11Z","fixes":[{"ecosystem":"Debian:12","package":"libplack-middleware-session-perl","fixed_in":["0.21-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libplack-middleware-session-perl","fixed_in":["0.21-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libplack-middleware-session-perl","fixed_in":["0.21-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libplack-middleware-session-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libplack-middleware-session-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libplack-middleware-session-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libplack-middleware-session-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libplack-middleware-session-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30-1","0.30-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libplack-middleware-session-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.32-1","0.33-1"]}],"products":[{"vendor":"miyagawa","product":"plack::middleware::session"},{"vendor":"plack","product":"plack-middleware-session"}],"references":[{"url":"https://github.com/plack/Plack-Middleware-Session/commit/b7f0252269ba1bb812b5dc02303754fe94c808e4","tags":["patch","Patch","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-10031"},{"url":"https://github.com/advisories/GHSA-rvh4-4hm5-gx4x"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-10031","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-10031","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-10031","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/35012183/","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-10031","title":"Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks","description":"Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks","status":"published","published":"2025-12-09T00:12:36.372Z","modified":"2025-12-11T14:36:31.485Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-1254"],"updated_at":"2026-11-02T14:34:55.825574Z"}],"euvd":[{"id":"EUVD-2013-7289","description":"Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks","status":"published","published":"2025-12-09T00:12:36Z","modified":"2025-12-11T14:36:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:06.661228Z"}],"ghsa":[{"id":"GHSA-rvh4-4hm5-gx4x","title":"Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks","description":"Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks","status":"published","published":"2025-12-09T03:31:08Z","modified":"2025-12-11T15:31:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-1254"],"updated_at":"2026-11-02T15:05:09.214908Z"}],"nvd":[{"id":"CVE-2013-10031","description":"Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks","status":"published","published":"2025-12-09T01:16:42.587Z","modified":"2026-06-16T23:50:34.1Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-1254"],"updated_at":"2026-11-02T14:02:52.934105Z"}],"osv":[{"id":"DEBIAN-CVE-2013-10031","description":"Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks","status":"published","published":"2025-12-09T01:16:42.587Z","modified":"2026-09-01T20:03:11.877552804Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"UBUNTU-CVE-2013-10031","description":"Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks","status":"published","published":"2025-12-09T01:16:00Z","modified":"2025-12-16T07:21:36.10155Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:06.854805Z"}]}}