CVE-2011-3599 The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine...
MediumCVSS 5.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcrypt-dsa-perl(Debian:12) | < 1.17-3 | 1.17-3 |
| debian/libcrypt-dsa-perl(Debian:13) | < 1.17-3 | 1.17-3 |
| adam kennedy crypt-dsa | <= 1.17 | No fix listed |
| adam kennedy crypt-dsa | = 0.01 | No fix listed |
| adam kennedy crypt-dsa | = 0.02 | No fix listed |
| adam kennedy crypt-dsa | = 0.03 | No fix listed |
| adam kennedy crypt-dsa | = 0.10 | No fix listed |
| adam kennedy crypt-dsa | = 0.11 | No fix listed |
| adam kennedy crypt-dsa | = 0.12 | No fix listed |
| adam kennedy crypt-dsa | = 0.13 | No fix listed |
| adam kennedy crypt-dsa | = 0.14 | No fix listed |
| adam kennedy crypt-dsa | = 0.15_01 | No fix listed |
| adam kennedy crypt-dsa | = 1.16 | No fix listed |
References
- Debian Security Tracker CVE-2011-3599 vendor-advisory
- 76025 vdb-entry
- 46275 third-party-advisory vendor-advisory
- [oss-security] 20111005 CVE Request -- perl-Crypt-DSA -- Cryptographically insecure method used for random numbers generation on systems without /dev/random mailing-list patch
- [oss-security] 20111005 Re: CVE Request -- perl-Crypt-DSA -- Cryptographically insecure method used for random numbers generation on systems without /dev/random mailing-list patch
- 49928 vdb-entry
- bugzilla.redhat.com patch
- rt.cpan.org patch
- bugs.debian.org issue-tracking