Crypt::DSA vulnerabilities
3 known vulnerabilities in Crypt::DSA from Timlegge. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Crypt::DSA: Use of Insufficiently Random Values
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery. "Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer
- 9.1 Critical severity
Crypt::DSA: Reusing a Nonce, Key Pair in Encryption
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, a
- 7.3 High severity
Crypt::DSA: Insufficient Entropy
Crypt::DSA versions before 1.20 for Perl generate seeds using rand. Seeds were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.