Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Fedora 41: 2025-5d61874568 critical: perl-String-Compare-ConstantTime leak

fedora
Calendar Grey April 17, 2025
Dist Fedora Esm H88
Important patch for Fedora 41 tackling the CVE-2024-13939 issue in String-Compare-ConstantTime implementation.
This release fixes CVE-2024-13939 (leaking the length of a secret string)

Summary

This module provides one function, "equals", which works like perl's "eq", but

which does not provide a timing side-channel. Such comparison is useful when

matching against a secret string.

Update Information:

This release fixes CVE-2024-13939 (leaking the length of a secret string)

Topics%20covered

Topics Covered

security advisory update Fedora bug fix timing attack string comparison

Change Log

* Tue Apr 1 2025 Petr Pisar - 0.321-21 - Fix CVE-2024-13939 (leaking the length of a secret string) (bug #2355705) * Tue Aug 6 2024 Miroslav Suchý - 0.321-20 - convert license to SPDX

References


[ 1 ] Bug #2355663 - CVE-2024-13939 String-Compare-ConstantTime: String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string https://bugzilla.redhat.com/show_bug.cgi?id=2355663

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-5d61874568' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: perl-String-Compare-ConstantTime
Product: Fedora 41
Version: 0.321
Release: 21.fc41
URL: https://metacpan.org/dist/String-Compare-ConstantTime
Summary: Timing side-channel protected string compare

Topics%20covered

Topics Covered

security advisory update Fedora bug fix timing attack string comparison

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here