- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3846-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/              Arturo Borrero Gonzalez
June 28, 2024                                 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : libmojolicious-perl
Version        : 8.12+dfsg-1.1~deb10u1
CVE ID         : CVE-2020-36829

Mojolicious is a Perl Web Application Framework built around the familiar
Model-View-Controller philosophy. It supports a simple single file mode via
Mojolicious::Lite, RESTful routes, plugins, Perl-ish templates, session
management, signed cookies, a testing framework, internationalization, first
class Unicode support, and more.

The libmojolicious-perl package had a timing attack vulnerability that allowed
an attacker to guess the length of a secret string.

For Debian 10 buster, this problem has been fixed in version
8.12+dfsg-1.1~deb10u1.

We recommend that you upgrade your libmojolicious-perl packages.

For the detailed security status of libmojolicious-perl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libmojolicious-perl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS