Homepage

CVE-2024-13939 Affecting libstring-compare-constanttime-perl package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-LIBSTRINGCOMPARECONSTANTTIMEPERL-9563986
  • published29 Mar 2025
  • disclosed28 Mar 2025
Report a new vulnerability Found a mistake?

Introduced: 28 Mar 2025

NewCVE-2024-13939  (opens in a new tab)

How to fix?

There is no fixed version for Debian:12 libstring-compare-constanttime-perl.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstring-compare-constanttime-perl package and not the libstring-compare-constanttime-perl package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)."

This is similar to CVE-2020-36829