EUVD-2026-30668
GHSA-5cq6-9f97-wjwx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.
AnalysisAI
File overwrite and information disclosure in Crypt::DSA through version 1.19 for Perl expose systems where user-controlled input reaches the library's key handling routines. The root cause is use of Perl's 2-argument open() form in lib/Crypt/DSA/Key.pm, which interprets leading or trailing special characters in filenames as I/O mode specifiers, enabling reads from or writes to arbitrary files. CVSS rates this AV:N/AC:L/PR:N/UI:N (Medium, 6.5), though actual exposure depends on application-level code paths; EPSS is 0.01% and this CVE is not in CISA KEV, indicating no public exploit identified at time of analysis.
Technical ContextAI
Crypt::DSA (CPE: cpe:2.3:a:timlegge:crypt::dsa:*:*:*:*:*:*:*:*) is a Perl CPAN module implementing the Digital Signature Algorithm, used for key generation, signing, and verification. The vulnerability maps to CWE-552 (Files or Directories Accessible to External Parties) and originates from the 2-argument form of Perl's open() - open(FH, $filename) - used in lib/Crypt/DSA/Key.pm. In this form, Perl treats leading characters such as '>' (write), '>>' (append), or '<' (read) and trailing '|' (pipe to shell) as mode qualifiers rather than literal filename characters. An application that supplies user-influenced data as the filename argument inadvertently grants those metacharacters semantic power. The fix in version 1.20, visible in the published diff at metacpan.org, converts these calls to the 3-argument form - open(FH, '<', $filename) - which treats the filename purely as a string, eliminating the ambiguity. The oss-security mailing list disclosure (openwall.com, 2026-05-15) and CPANSec reporting corroborate this as a library-level defect.
RemediationAI
Upgrade Crypt::DSA to version 1.20 or later - the vendor-released patch for this vulnerability. Version 1.20 replaces the unsafe 2-argument open() calls in lib/Crypt/DSA/Key.pm with the 3-argument form, eliminating metacharacter interpretation. The changelog and diff are published at https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/changes. Upgrade can be performed via cpan or cpanm: 'cpanm Crypt::DSA' or 'cpan -i Crypt::DSA'. Where immediate patching is not possible, the specific compensating control is to validate and sanitize filenames in application code before passing them to any Crypt::DSA key function - reject or strip characters including '>', '<', '|', and null bytes. This adds input validation logic to the calling application without modifying the library, but does not address the root cause and may be bypassed if sanitization is incomplete.
Perl Crypt::NaCl::Sodium module through 2.002 has potential integer overflows in cryptographic operations that could wea
Integer overflow in Crypt::NaCl::Sodium Perl module through version 2.001 on 32-bit systems. The Sodium.xs binding casts
Heap out-of-bounds read in the Crypt::OpenSSL::X509 Perl module (versions before 2.1.3) lets a crafted X.509 certificate
Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, lead
Heap buffer overflow in Crypt::SysRandom::XS before version 0.010 allows denial of service through negative length param
Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined
Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, if Crypt::SecretBuff
Weak salt generation in Crypt::PasswdMD5 (Perl) through version 1.42 enables password hash cracking via predictable rand
Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl
Predictable salt generation in the Perl Crypt::PBKDF2 module before version 0.261630 weakens the cryptographic strength
Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. Rated medium severity (CVSS 5.9), this
Same technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today