The TIMLEGGE Crypt::DSA module for Perl versions prior to 1.20 generates seeds for cryptographic operations using Perl's built-in rand function. Since rand is predictable and not designed for cryptographic security, this results in insufficient entropy (CWE-331) during key generation. This weakness can potentially compromise the security of the DSA keys generated by the module. No CVSS score or detailed vendor advisory is available, and no patch or official remediation information has been provided.

The insufficient entropy in seed generation can lead to predictable cryptographic keys, weakening the security of digital signatures generated using Crypt::DSA. This may allow attackers to reproduce or predict keys, potentially compromising data integrity and authentication mechanisms relying on these keys. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid using Crypt::DSA versions before 1.20 for security-critical applications until an official fix or update is released. Consider using alternative cryptographic modules that employ secure random number generation.