CVE-2011-3599: Medium severity crypt-dsa (adam kennedy) vulnerability
It has been reported that Crypt::DSA, a Perl module for DSA signatures and key generation, used cryptographically weak / insecure method for random numbers generation on systems, where /dev/random file was not present. Due this flaw an attacker could be able to discover some portions of / whole secret DSA key, which has been created on such system.
References: [1] http://secunia.com/advisories/46275/ [2] https://rt.cpan.org/Public/Bug/Display.html?id=71421
Proposed upstream patch is to remove the affected fallback code part: [3] https://rt.cpan.org/Public/Bug/Display.html?id=71421#txn-984052 (though not approved yet)
Other sources
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3599?
CVE-2011-3599 is considered a high severity vulnerability due to its potential to allow attackers to compromise cryptographic security.
How do I fix CVE-2011-3599?
To fix CVE-2011-3599, you should upgrade the Crypt::DSA Perl module to version 1.17 or later.
Which versions of Crypt::DSA are affected by CVE-2011-3599?
CVE-2011-3599 affects Crypt::DSA versions prior to 1.17, including versions 0.01 through 1.16.
What kind of flaw is CVE-2011-3599?
CVE-2011-3599 is a cryptographic flaw involving weak random number generation.
Who is the vendor of the affected software in CVE-2011-3599?
The affected software, Crypt::DSA, is maintained by Adam Kennedy.