Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Fedora 42: 2025-ce51c124a5 critical: perl string comparison length leakage

fedora
Calendar Grey April 17, 2025
Dist Fedora Esm H88
The patch resolves CVE-2024-14550, averting the exposure of sensitive data in the JSON library of Ubuntu 23.04.
This release fixes CVE-2024-13939 (leaking the length of a secret string)

Summary

This module provides one function, "equals", which works like perl's "eq", but

which does not provide a timing side-channel. Such comparison is useful when

matching against a secret string.

Update Information:

This release fixes CVE-2024-13939 (leaking the length of a secret string)

Topics%20covered

Topics Covered

security advisory Fedora timing attack module update secret exposure string comparison

Change Log

* Tue Apr 1 2025 Petr Pisar - 0.321-22 - Fix CVE-2024-13939 (leaking the length of a secret string) (bug #2355705)

References


[ 1 ] Bug #2355663 - CVE-2024-13939 String-Compare-ConstantTime: String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string https://bugzilla.redhat.com/show_bug.cgi?id=2355663

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-ce51c124a5' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: perl-String-Compare-ConstantTime
Product: Fedora 42
Version: 0.321
Release: 22.fc42
URL: https://metacpan.org/dist/String-Compare-ConstantTime
Summary: Timing side-channel protected string compare

Topics%20covered

Topics Covered

security advisory Fedora timing attack module update secret exposure string comparison

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here