/ 
Crypt-Perl-0.22-TRIAL1
/ Crypt::Perl::X509::Extension::acmeValidation_v1
Security Advisories (2)
CVE-2020-17478 (2020-08-10)

ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplication algorithm.

CVE-2020-13895 (2020-06-07)

Crypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 (prime256v1). This could conceivably have a security-relevant impact if an attacker wishes to use public r and s values when guessing whether signature verification will fail.

NAME

SYNOPSIS

See Crypt::Perl::X509v3 for a more useful syntax for instantiating this extension as part of certificate creation. The following is how to instantiate it directly .. which isn’t very useful per se.

my $extn = Crypt::Perl::X509::Extension::acmeValidation_v1->new(
    $string_of_32_octets,
);

DESCRIPTION

This is the extension to use with the experimental ACME TLS ALPN challenge, described at https://datatracker.ietf.org/doc/draft-ietf-acme-tls-alpn/.