CVE-2011-3599
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses...
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
Exploit likelihood
What each source reports
NVD Score used
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
- Record
CVE-2011-3599- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
- Record
CVE-2011-3599- Updated
- 2026-11-02
EUVDEUVD-2011-3558 No score
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
- Record
EUVD-2011-3558- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-93qx-3vc3-hx46 No score
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses...
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
- Record
GHSA-93qx-3vc3-hx46- Updated
- 2026-11-02
OSV No score
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
- Record
CVE-2011-3599- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-3599 No score
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
- Record
DEBIAN-CVE-2011-3599- Updated
- 2026-11-02
OSVMGASA-2013-0289 No score
Updated perl-Crypt-DSA package fixes security vulnerability
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack (CVE-2011-3599).
This update removes the fallback to Data::Random.
- Record
MGASA-2013-0289- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libcrypt-dsa-perlDebian:12 |
before 1.17-3 | 1.17-3 |
libcrypt-dsa-perlDebian:13 |
before 1.17-3 | 1.17-3 |
perl-Crypt-DSAMageia:2 |
before 1.170.0-1.1.mga2 | 1.170.0-1.1.mga2 |
perl-Crypt-DSAMageia:3 |
before 1.170.0-2.1.mga3 | 1.170.0-2.1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-3599 is a medium vulnerability (CVSS 5.8) in Adam Kennedy Crypt-dsa, published October 10, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.96%, the 80th percentile. Fixed in libcrypt-dsa-perl 1.17-3.
References
securityfocus.com/bid/49928
openwall.com/lists/oss-security/2011/10/05/9
osvdb.org/76025
rt.cpan.org/Public/Bug/Display.html?id=71421
bugzilla.redhat.com/show_bug.cgi?id=743567
Show 7 moreShow less
secunia.com/advisories/46275
nvd.nist.gov/vuln/detail/CVE-2011-3599
github.com/advisories/GHSA-93qx-3vc3-hx46
security-tracker.debian.org/tracker/CVE-2011-3599
advisories.mageia.org/MGASA-2013-0289.html
bugs.mageia.org/show_bug.cgi?id=11226
lists.fedoraproject.org/pipermail/package-announce/2013-September/115603.html