From the third-party advisory at $URL: Description A security issue has been reported in the Crypt-DSA module for Perl, which can be exploited by malicious people to bypass certain security restrictions. The security issue is caused due to the module using a cryptographically insecure method to generate random numbers when "/dev/random" is not available, which can lead to cryptographically weak keys. Successful exploitation requires that "/dev/random" is not available (e.g. running on a Windows system). The security issue is reported in version 1.17. Other versions may also be affected.
Tim, imho linux is not affected, because there is /dev/random. What do you think about?
CVE-2011-3599 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3599): The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
(In reply to comment #1) > Tim, imho linux is not affected, because there is /dev/random. What do you > think about? No idea. ;) @perl?
How about asking Prefix? IIRC they have some windows prefix, maybe they will be affected?
Sorry for bugspam, @prefix, package has no windows-related keywords So, @perl - your turn :-)
I'd say it is not actual for us
