CVE-2009-0129: libcrypt-openssl-dsa-perl does not properly check the return value from the OpenSSL DSA_verify and DSA_do_v...

Security readout for executives and security teams

This is a legacy Perl cryptography-library flaw where bad error handling could let malformed SSL/TLS signatures be treated as valid. If an application relied on this library for certificate-chain validation, trust decisions could be bypassed. The source bundle does not provide affected versions, a CVSS score, or a named patch. Most likely exposure is legacy Perl applications or systems carrying libcrypt-openssl-dsa-perl and using it in DSA signature or certificate validation paths. Exposure cannot be assumed from package presence alone; validate actual application usage. Prioritize based on confirmed usage. This is not a broad modern-internet emergency from the supplied evidence, but it matters for legacy systems that depend on this Perl library for certificate trust decisions. Mitigation focus: Inventory systems and applications using libcrypt-openssl-dsa-perl.; Check Debian and upstream package guidance for fixed or safe versions.; Update or remove the dependency where vendor guidance recommends it..

Prepared

Jun 28, 2026, 11:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.