Security Advisories (2)
CVE-2020-17478 (2020-08-10)

ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplication algorithm.

CVE-2020-13895 (2020-06-07)

Crypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 (prime256v1). This could conceivably have a security-relevant impact if an attacker wishes to use public r and s values when guessing whether signature verification will fail.

NAME

Crypt::Perl::X509::Extension::subjectDirectoryAttributes

NOTES

This module is EXPERIMENTAL.

Are you sure you need this extension? Because OpenSSL doesn’t seem to pay it much regard: man 5 x509v3_config doesn’t mention it, and I can’t find any certificates that use it. Also, despite the fact that this module, as best I can tell, implements the extension as it’s consistently described everywhere I’ve found, OpenSSL doesn’t render this module’s output cleanly. (i.e., when using the -text flag of openssl x509). Maybe there’s a mistake in this module’s ASN.1 logic? It’s not complicated, so I’m not sure what would be wrong.

In the absence of a parser against which to test this module’s output, I’m a bit perplexed. Please drop me a line if you can shed light on the situation.

SEE ALSO

https://tools.ietf.org/html/rfc5280#section-4.2.1.8