Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the…
9b29abf9-4ab0-4765-b253-1875cd9b441e·CWE-323·Published 2026-06-15
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r". Keys used to sign more than once with an affected version should be considered compromised.
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r". Keys used to sign more than once with an affected version should be considered compromised.
Las versiones de Crypt::DSA anteriores a la 1.21 para Perl reutilizaban el nonce entre firmas, lo que llevaba a la recuperación de la clave privada. Crypt::DSA::sign cachea el material nonce por firma en el objeto Key sin borrarlo nunca. El primer sign() en un objeto Key elige un nonce, y cada sign() posterior en ese mismo objeto lo reutiliza, produciendo una ’r’ idéntica. Las claves utilizadas para firmar más de una vez con una versión afectada deben considerarse comprometidas.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | cve.org | 9.1 | — | — | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | Primary | cve.org | 9.1 | — | — | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | Secondary | NVD | 9.1 | 3.9 | 5.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | Secondary | ENISA EUVD | 9.1 | — | — | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |