Timlegge vulnerabilities
We track 13 vulnerabilities in Timlegge products across 6 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on August 3, 2026.
Latest Timlegge vulnerabilities
- 7.5 High severity
XML::Sig: Improper Verification of Cryptographic Signature
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the `//dsig:Signature` elements into `$numsigs` an
- 9.1 Critical severity
XML::Sig: Improper Verification of Cryptographic Signature
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node
- 9.1 Critical severity
XML::Sig: Improper Neutralization of Data within XPath Expressions
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither
- 9.8 Critical severity
Net::SAML2: Improper Verification of Cryptographic Signature
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature. _verify_encrypted_assertion decrypts the EncryptedAssertion and returns it as v
- 8.1 High severity
Net::SAML2: Improper Verification of Cryptographic Signature
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree. new_from_xml reads the NameID, attribute values, SessionI
- 7.5 High severity
Net::SAML2: Improper Certificate Validation
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured. verify_xml in Net::SAML2::Role::VerifyXML runs "return if !$anchors &&
- 7.5 High severity
Crypt::DSA: Use of Insufficiently Random Values
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery. "Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer
- 9.1 Critical severity
Crypt::DSA: Reusing a Nonce, Key Pair in Encryption
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, a
- 7.3 High severity
Crypt::DSA: Insufficient Entropy
Crypt::DSA versions before 1.20 for Perl generate seeds using rand. Seeds were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.
- 9.8 Critical severity
Crypt::NaCl::Sodium: Integer Overflow or Wraparound
Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows. bin2hex, encrypt, aes256gcm_encrypt_afternm and seal functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an unde
- 9.1 Critical severity
Crypt::NaCl::Sodium: Integer Overflow or Wraparound
Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems. Sodium.xs casts a STRLEN (size_t) to unsigned long long when passing a length pointer to libsodium functions. On 32-bit systems size_t is typically 32-bits whil
- 9.3 Critical severity
XML::Sig: Improper Verification of Cryptographic Signature
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML fil
- 8.8 High severity
Crypt::Random: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Ran