Alerts This Week
Warning Icon 1 975
Alerts This Week
Warning Icon 1 975

Fedora 44 perl-Crypt-DSA Critical Key Reuse Vulnerability 2026-f4a6b0c635

fedora
Calendar Grey June 23, 2026
Dist Fedora Esm H88
Update for perl-Crypt-DSA in Fedora 44 prevents key material reuse for improved security against nonce issues.
This update, to the current upstream release, prevents key material reuse for multiple signing events (CVE-2026-12205, CWE-323).

Summary

Crypt::DSA is an implementation of the DSA (Digital Signature Algorithm)

signature verification system. This package provides DSA signing, signature

verification, and key generation.

DSA (Digital Signature Algorithm) signatures are no longer considered to be

adequate for security. This module should only be used for verifying old

signatures and should not be used for new signatures. That being said, some

technologies still require DSA signatures even now. Consider using other

solutions or explicitly not using DSA signatures. Crypt-DSA-GMP is a possible

replacement.

Update Information:

This update, to the current upstream release, prevents key material reuse for multiple signing events (CVE-2026-12205, CWE-323).

Topics%20covered

Topics Covered

security advisory fedora critical key reuse CWE-323 perl-Crypt-DSA

Change Log

* Mon Jun 15 2026 Paul Howarth - 1.21-1 - Update to 1.21 - Fixed key material reuse for multiple signing events (CVE-2026-12205, CWE-323) - sign() reused the DSA nonce k across signatures (r and k^-1 were cached on the key and not regenerated), allowing private-key recovery from two signatures over different messages - Now generates a fresh nonce per signature - Keys used to sign more than once with an affected version should be considered compromised * Fri Jun 12 2026 Yaakov Selkowitz - 1.20-2 - Rebuilt for openssl 4.0

References


[ 1 ] Bug #2491340 - CVE-2026-12205 perl-Crypt-DSA: Crypt::DSA: Private-key recovery via nonce reuse across signatures [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2491340

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-f4a6b0c635' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: perl-Crypt-DSA
Product: Fedora 44
Version: 1.21
Release: 1.fc44
URL: https://metacpan.org/release/Crypt-DSA
Summary: Perl module for DSA signatures and key generation

Topics%20covered

Topics Covered

security advisory fedora critical key reuse CWE-323 perl-Crypt-DSA

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here