From =?UTF-8?Q?Moritz_M=C3=BChlenhoff?=@21:1/5 to All on Fri Mar 28 15:50:01 2025
Source: libstring-compare-constanttime-perl
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security
Hi,
The following vulnerability was published for libstring-compare-constanttime-perl.
CVE-2024-13939[0]:
| String::Compare::ConstantTime for Perl through 0.321 is vulnerable
| to timing attacks that allow an attacker to guess the length of a
| secret string. As stated in the documentation: "If the lengths of
| the strings are different, because equals returns false right away
| the size of the secret string may be leaked (but not its contents)."
| This is similar to CVE-2020-36829