Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Fedora 40: 2025-e6f5710dba critical: perl String Comparison Timing Attack

fedora
Calendar Grey April 17, 2025
Dist Fedora Esm H88
The perl-String-Compare-ConstantTime package update addresses the length leakage vulnerability in Fedora 40. Improvements made to the secure string comparison protocol.
This release fixes CVE-2024-13939 (leaking the length of a secret string)

Summary

This module provides one function, "equals", which works like perl's "eq", but

which does not provide a timing side-channel. Such comparison is useful when

matching against a secret string.

Update Information:

This release fixes CVE-2024-13939 (leaking the length of a secret string)

Topics%20covered

Topics Covered

security advisory Fedora update information timing attack module fix string comparison

Change Log

* Tue Apr 1 2025 Petr Pisar - 0.321-19 - Fix CVE-2024-13939 (leaking the length of a secret string) (bug #2355704) * Tue Aug 6 2024 Miroslav Suchý - 0.321-18 - convert license to SPDX

References


[ 1 ] Bug #2355663 - CVE-2024-13939 String-Compare-ConstantTime: String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string https://bugzilla.redhat.com/show_bug.cgi?id=2355663

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-e6f5710dba' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: perl-String-Compare-ConstantTime
Product: Fedora 40
Version: 0.321
Release: 19.fc40
URL: https://metacpan.org/dist/String-Compare-ConstantTime
Summary: Timing side-channel protected string compare

Topics%20covered

Topics Covered

security advisory Fedora update information timing attack module fix string comparison

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here