logo_clicknbuy.png

CVE-2024-13939 – Apache::String::Compare::ConstantTime Timing Attack Vulnerability

The following table lists the changes that have been made to the
CVE-2024-13939 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by 9b29abf9-4ab0-4765-b253-1875cd9b441e

    Mar. 28, 2025

    Action Type Old Value New Value
    Added Description String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

    As stated in the documentation: “If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents).”

    This is similar to CVE-2020-36829
    Added CWE CWE-208
    Added Reference https://metacpan.org/release/FRACTAL/String-Compare-ConstantTime-0.321/view/lib/String/Compare/ConstantTime.pm#TIMING-SIDE-CHANNEL
Share the Post:

Related Posts