OPENSUSE-SU-2026:20936-1

Vulnerability from csaf_opensuse - Published: 2026-06-10 11:48 - Updated: 2026-09-17 17:34
Summary
Security update for perl-CryptX
Severity
Important
Notes
Title of the patch: Security update for perl-CryptX
Description of the patch: This update for perl-CryptX fixes the following issues: Changes in perl-CryptX: - updated to 0.89.0 (0.089) see /usr/share/doc/packages/perl-CryptX/Changes 0.089 2026-05-10 - new: Crypt::ASN1 - new: Crypt::AuthEnc::SIV - new: Crypt::AuthEnc::XChaCha20Poly1305 - new: Crypt::Cipher::SM4 - new: Crypt::Digest::TurboSHAKE - new: Crypt::Digest::KangarooTwelve - new: Crypt::PK::Ed448 - new: Crypt::PK::X448 - new: Crypt::Stream::XChaCha - new: Crypt::Stream::XSalsa20 - Crypt::PK::Ed25519 - new functions: sign_message_ctx, verify_message_ctx, sign_message_ph, verify_message_ph - Crypt::Digest: object digest accessors now finalize the object; use reset() before reuse - Crypt::Mac + Crypt::AuthEnc: finalized-object lifecycle is now enforced consistently - security/hardening fixes across Digest/Mac/AuthEnc/Mode/Stream/PK/PRNG - fixes related to wycheproof test suite - documentation cleanup & improvements - support for RFC 8702 RSA-PSS-SHAKE128/256 and ECDSA-SHAKE128/256 - support for FRP256v1 elliptic-curve - bundled libtomcrypt update branch:develop (commit: 8b5af49b 2026-05-06) - CVE-2026-41565 bsc#1266804 0.088 2026-04-23 - Crypt::KeyDerivation - new functions: pbkdf1_openssl, bcrypt_pbkdf, scrypt_pbkdf, argon2_pbkdf - Crypt::Misc - new functions: random_v7uuid, is_uuid - bundled libtomcrypt update branch:develop (commit: 2e441a17 2026-04-15) - bundled libtommath update branch:develop (commit: ae40a87 2026-04-20) - security fix CVE-2026-41564 https://github.com/DCIT/perl-CryptX/security/advisories/GHSA-24c2-gp6c-24c6 bsc#1262697 - CVE-2026-41565 bsc#1266804
Patchnames: openSUSE-Leap-16.0-packagehub-304
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-41564
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-41565
Affected products
Recommended 4 products, the same list as for CVE-2026-41564
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for perl-CryptX",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for perl-CryptX fixes the following issues:\n\nChanges in perl-CryptX:\n\n- updated to 0.89.0 (0.089)\n   see /usr/share/doc/packages/perl-CryptX/Changes\n\n  0.089   2026-05-10\n          - new: Crypt::ASN1\n          - new: Crypt::AuthEnc::SIV\n          - new: Crypt::AuthEnc::XChaCha20Poly1305\n          - new: Crypt::Cipher::SM4\n          - new: Crypt::Digest::TurboSHAKE\n          - new: Crypt::Digest::KangarooTwelve\n          - new: Crypt::PK::Ed448\n          - new: Crypt::PK::X448\n          - new: Crypt::Stream::XChaCha\n          - new: Crypt::Stream::XSalsa20\n          - Crypt::PK::Ed25519 - new functions: sign_message_ctx, verify_message_ctx, sign_message_ph, verify_message_ph\n          - Crypt::Digest: object digest accessors now finalize the object; use reset() before reuse\n          - Crypt::Mac + Crypt::AuthEnc: finalized-object lifecycle is now enforced consistently\n          - security/hardening fixes across Digest/Mac/AuthEnc/Mode/Stream/PK/PRNG\n          - fixes related to wycheproof test suite\n          - documentation cleanup \u0026 improvements\n          - support for RFC 8702 RSA-PSS-SHAKE128/256 and ECDSA-SHAKE128/256\n          - support for FRP256v1 elliptic-curve\n          - bundled libtomcrypt update branch:develop (commit: 8b5af49b 2026-05-06)\n          - CVE-2026-41565 bsc#1266804\n\n  0.088   2026-04-23\n          - Crypt::KeyDerivation - new functions: pbkdf1_openssl, bcrypt_pbkdf, scrypt_pbkdf, argon2_pbkdf\n          - Crypt::Misc - new functions: random_v7uuid, is_uuid\n          - bundled libtomcrypt update branch:develop (commit: 2e441a17 2026-04-15)\n          - bundled libtommath update branch:develop (commit: ae40a87 2026-04-20)\n          - security fix CVE-2026-41564 https://github.com/DCIT/perl-CryptX/security/advisories/GHSA-24c2-gp6c-24c6\n            bsc#1262697\n          - CVE-2026-41565 bsc#1266804\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-304",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20936-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1244472",
        "url": "https://bugzilla.suse.com/1244472"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262697",
        "url": "https://bugzilla.suse.com/1262697"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266804",
        "url": "https://bugzilla.suse.com/1266804"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41564 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41564/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41565 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41565/"
      }
    ],
    "title": "Security update for perl-CryptX",
    "tracking": {
      "current_release_date": "2026-09-17T17:34:42Z",
      "generator": {
        "date": "2026-06-10T11:48:58Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20936-1",
      "initial_release_date": "2026-06-10T11:48:58Z",
      "revision_history": [
        {
          "date": "2026-06-10T11:48:58Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:37:15Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:39:57Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:34:42Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-CryptX-0:0.89.0-bp160.1.1.aarch64",
                "product": {
                  "name": "perl-CryptX-0:0.89.0-bp160.1.1.aarch64",
                  "product_id": "perl-CryptX-0:0.89.0-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-CryptX@0.89.0-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-CryptX-0:0.89.0-bp160.1.1.ppc64le",
                "product": {
                  "name": "perl-CryptX-0:0.89.0-bp160.1.1.ppc64le",
                  "product_id": "perl-CryptX-0:0.89.0-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-CryptX@0.89.0-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-CryptX-0:0.89.0-bp160.1.1.s390x",
                "product": {
                  "name": "perl-CryptX-0:0.89.0-bp160.1.1.s390x",
                  "product_id": "perl-CryptX-0:0.89.0-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-CryptX@0.89.0-bp160.1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-CryptX-0:0.89.0-bp160.1.1.x86_64",
                "product": {
                  "name": "perl-CryptX-0:0.89.0-bp160.1.1.x86_64",
                  "product_id": "perl-CryptX-0:0.89.0-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-CryptX@0.89.0-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-CryptX-0:0.89.0-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.aarch64"
        },
        "product_reference": "perl-CryptX-0:0.89.0-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-CryptX-0:0.89.0-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.ppc64le"
        },
        "product_reference": "perl-CryptX-0:0.89.0-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-CryptX-0:0.89.0-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.s390x"
        },
        "product_reference": "perl-CryptX-0:0.89.0-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-CryptX-0:0.89.0-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.x86_64"
        },
        "product_reference": "perl-CryptX-0:0.89.0-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41564",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41564"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking.\n\nThe Crypt::PK::RSA, Crypt::PK::DSA, Crypt::PK::DH, Crypt::PK::ECC, Crypt::PK::Ed25519 and Crypt::PK::X25519 modules seed a per-object PRNG state in their constructors and reuse it without fork detection. A Crypt::PK::* object created before `fork()` shares byte-identical PRNG state with every child process, and any randomized operation they perform can produce identical output, including key generation. Two ECDSA or DSA signatures from different processes are enough to recover the signing private key through nonce-reuse key recovery.\n\nThis affects preforking services such as the Starman web server, where a Crypt::PK::* object loaded at startup is inherited by every worker process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41564",
          "url": "https://www.suse.com/security/cve/CVE-2026-41564"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262697 for CVE-2026-41564",
          "url": "https://bugzilla.suse.com/1262697"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-10T11:48:58Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-41564"
    },
    {
      "cve": "CVE-2026-41565",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41565"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers.\n\nThe gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authentication tag into a fixed 144-byte stack buffer (MAXBLOCKSIZE) without checking the supplied length. A longer tag overwrites the stack past the buffer. Version 0.088 added the clamp to gcm_decrypt_verify, and 0.088_001 added it to the other three.\n\nAny caller of an affected helper that forwards an attacker-controlled tag longer than the buffer can trigger the overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41565",
          "url": "https://www.suse.com/security/cve/CVE-2026-41565"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266804 for CVE-2026-41565",
          "url": "https://bugzilla.suse.com/1266804"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:perl-CryptX-0:0.89.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-10T11:48:58Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-41565"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.