========================================================================
CVE-2026-8704                                        CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-8704
   Distribution:  Crypt-DSA
       Versions:  through 1.19

       MetaCPAN:  https://metacpan.org/dist/Crypt-DSA
       VCS Repo:  https://github.com/perl-Crypt-OpenPGP/Crypt-DSA

Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing
existing files to be modified

Description
-----------
Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing
existing files to be modified.

Problem types
-------------
- CWE-552 Files or Directories Accessible to External Parties

Solutions
---------
Upgrade to version 1.20

References
----------
https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/changes
https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/diff/TIMLEGGE/Crypt-DSA-1.19#lib/Crypt/DSA/Key.pm

Timeline
--------
- 2026-05-15: CPANSec identified issue
- 2026-05-15: Author was notified
- 2026-05-15: Version 1.20 released.