Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids

A Perl plugin for Catalyst web framework may expose user session IDs to attackers if the connection to the statsd monitoring service isn't encrypted. An attacker could intercept these session IDs and use them to impersonate users.

Catalyst::Plugin::Statsd versions ≤0.10.0 transmit session identifiers in cleartext to statsd daemons over unencrypted channels (e.g., UDP). An attacker on the network path can passively intercept session IDs and use them as authentication tokens to gain unauthorized access to user accounts or sessions.