This release fixes CVE-2024-13939 (leaking the length of a secret string). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-e6f5710dba 2025-04-17 19:32:14.984687+00:00 -------------------------------------------------------------------------------- Name : perl-String-Compare-ConstantTime Product : Fedora 40 Version : 0.321 Release : 19.fc40 URL : https://metacpan.org/dist/String-Compare-ConstantTime Summary : Timing side-channel protected string compare Description : This module provides one function, "equals", which works like perl's "eq", but which does not provide a timing side-channel. Such comparison is useful when matching against a secret string. -------------------------------------------------------------------------------- Update Information: This release fixes CVE-2024-13939 (leaking the length of a secret string) -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 1 2025 Petr Pisar - 0.321-19 - Fix CVE-2024-13939 (leaking the length of a secret string) (bug #2355704) * Tue Aug 6 2024 Miroslav Suchý - 0.321-18 - convert license to SPDX -------------------------------------------------------------------------------- References: [ 1 ] Bug #2355663 - CVE-2024-13939 String-Compare-ConstantTime: String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string https://bugzilla.redhat.com/show_bug.cgi?id=2355663 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-e6f5710dba' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keysused by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- . The perl-String-Compare-ConstantTime package update addresses the length leakage vulnerability in Fedora 40. Improvements made to the secure string comparison protocol.. Fedora Update, perl module, string comparison, timing attack, security fix. . Severity: Critical. LinuxSecurity.com Team
User data leak in snmp_facts module (CVE-2021-20178). Multiple collections exposed secured values (CVE-2021-20191). In basic.py, no_log with fallback option (CVE-2021-20228). The ansible package has been patched to fix these issues. . MGASA-2021-0131 - Updated ansible packages fix security vulnerability Publication date: 12 Mar 2021 URL: https://advisories.mageia.org/MGASA-2021-0131.html Type: security Affected Mageia releases: 7 CVE: CVE-2021-20178, CVE-2021-20191, CVE-2021-20228 User data leak in snmp_facts module (CVE-2021-20178). Multiple collections exposed secured values (CVE-2021-20191). In basic.py, no_log with fallback option (CVE-2021-20228). The ansible package has been patched to fix these issues. References: - https://bugs.mageia.org/show_bug.cgi?id=28436 - https://access.redhat.com/errata/RHSA-2021:0664 - https://www.cve.org/CVERecord?id=CVE-2021-20178 - https://www.cve.org/CVERecord?id=CVE-2021-20191 - https://www.cve.org/CVERecord?id=CVE-2021-20228 SRPMS: - 7/core/ansible-2.7.18-1.2.mga7 . Revised Ansible distributions for Mageia address several security vulnerabilities linked to information leaks and module disclosures.. Ansible Patch Update, Mageia Security Fix, Data Exposure Resolution. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.