CVE-2011-3599: The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data:...

Security readout for executives and security teams

This issue affects older Perl Crypt::DSA signing code when it runs on systems without /dev/random. In that condition, weak random number generation can make DSA signatures guessable enough for attackers to spoof signatures or recover a signing key by brute force. Exposure is likely limited to legacy Perl applications using Crypt::DSA 1.17 or earlier for signing on systems lacking /dev/random. Risk increases where those signatures protect authentication, software updates, tokens, or other trust decisions. Treat this as a targeted legacy-crypto risk, not a broad internet emergency. Prioritize if the organization still uses Perl Crypt::DSA for security decisions, especially on older or minimal systems where /dev/random may be absent. Mitigation focus: Inventory Perl applications and packages for Crypt::DSA or Crypt-DSA version 1.17 or earlier.; Check CPAN, OS vendor, and distribution guidance for supported updates or mitigations.; Do not run affected DSA signing workflows on systems lacking cryptographic OS randomness..

Prepared

Jun 27, 2026, 17:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.