CVE-2026-12205
Description
A flaw was found in Crypt::DSA, a Perl module for Digital Signature Algorithm (DSA) cryptography. This vulnerability occurs because the software reuses a unique random number, known as a nonce, for multiple digital signatures generated with the same cryptographic key. An attacker could exploit this flaw to recover the private key, which would compromise the security of any data signed with that key.
Statement
This is an Important flaw in the perl-Crypt-DSA module, allowing private key recovery due to nonce reuse across multiple digital signatures generated with the same key. An attacker could exploit this to compromise data signed with the affected key. This risk is present when applications repeatedly use the same Crypt::DSA key object for signing without proper nonce regeneration.
Mitigation
To mitigate this issue, ensure that a new Crypt::DSA Key object is instantiated for each digital signature operation. Reusing the same Key object for multiple signatures will lead to nonce reuse and potential private key recovery. If a service or application uses Crypt::DSA for signing, it should be restarted after implementing this change to ensure new key objects are used.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
Potentially a replay attack, in which an attacker could send the same data twice, could be crafted if nonces are allowed to be reused. This could allow a user to send a message which masquerades as a valid message from a valid user.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
