[<prev] [next>] [day] [month] [year] [list]
Message-ID: <11f05be71f0408fd4106472a85084cbe@cpansec.org>
Date: Fri, 15 May 2026 19:12:25 -0300
From: Timothy Legge <timlegge@...nsec.org>
To: Cve Announce <cve-announce@...urity.metacpan.org>, Oss Security
<oss-security@...ts.openwall.com>
Subject: CVE-2026-8700: Crypt::DSA versions before 1.20 for Perl generate
seeds using rand
========================================================================
CVE-2026-8700 CPAN Security Group
========================================================================
CVE ID: CVE-2026-8700
Distribution: Crypt-DSA
Versions: before 1.20
MetaCPAN: https://metacpan.org/dist/Crypt-DSA
VCS Repo: https://github.com/perl-Crypt-OpenPGP/Crypt-DSA.git
Crypt::DSA versions before 1.20 for Perl generate seeds using rand
Description
-----------
Crypt::DSA versions before 1.20 for Perl generate seeds using rand.
Seeds were generated using Perl's built-in rand function, which is
predictable and unsuitable for security usage.
Problem types
-------------
- CWE-331 Insufficient Entropy
Solutions
---------
Upgrade to version 1.20 or later.
References
----------
https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/changes
https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/diff/TIMLEGGE/Crypt-DSA-1.19#lib/Crypt/DSA/KeyChain.pm
Timeline
--------
- 2026-05-15: CPANSec identified issue
- 2026-05-15: Author was notified
- 2026-05-15: Version 1.20 released.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
