========================================================================
CVE-2026-14570 CPAN Security Group
========================================================================
CVE ID: CVE-2026-14570
Distribution: Crypt-DSA
Versions: before 1.22
MetaCPAN: https://metacpan.org/dist/Crypt-DSA
VCS Repo: https://github.com/perl-Crypt-OpenPGP/Crypt-DSA
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and
private key from a biased random generator, leading to private-key
recovery
Description
-----------
Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and
private key from a biased random generator, leading to private-key
recovery.
"Crypt::DSA::Util::makerandom forces the high bit of every value it
returns to obtain an exactly N-bit integer for prime search. The
signing nonce and the private key are drawn from makerandom. Because
the high bit is always set, the result is not uniform: its top bit is
fixed, producing insecure values."
An attacker who collects a modest number of signatures under an
affected key, together with the public key, can recover the private key
with a lattice attack.
Keys used to sign with an affected version should be considered
compromised and new keys should be generated.
Problem types
-------------
- CWE-330 Use of Insufficiently Random Values
Solutions
---------
Upgrade to version 1.22 or later, which draws the nonce and private key
uniformly via rejection sampling (Crypt::DSA::Util::randombelow) with
no forced high bit.
Revoke and regenerate any keys used to sign with an affected version.
Crypt::DSA was deprecated in version 1.20. You should migrate to
another solution.
References
----------
https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.21/source/lib/Crypt/DSA/Util.pm#L56
https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.22/diff/TIMLEGGE/Crypt-DSA-1.21#lib/Crypt/DSA/Util.pm
https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.22/changes
