CVE-2024-13939

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-13939
String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)." This is similar to CVE-2020-36829

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://metacpan.org/release/FRACTAL/String-Compare-ConstantTime-0.321/view/lib/String/Compare/ConstantTime.pm#TIMING-SIDE-CHANNEL Technical Description
Configurations

Configuration 1 (hide)

cpe:2.3:a:fractal:string\:\:compare\:\:constanttime:*:*:*:*:*:perl:*:*
History

11 Apr 2025, 18:10

Type Values Removed Values Added
CWE CWE-203
References () https://metacpan.org/release/FRACTAL/String-Compare-ConstantTime-0.321/view/lib/String/Compare/ConstantTime.pm#TIMING-SIDE-CHANNEL - () https://metacpan.org/release/FRACTAL/String-Compare-ConstantTime-0.321/view/lib/String/Compare/ConstantTime.pm#TIMING-SIDE-CHANNEL - Technical Description
CPE cpe:2.3:a:fractal:string\:\:compare\:\:constanttime:*:*:*:*:*:perl:*:*
First Time Fractal
Fractal string\
Summary
  • (es) String::Compare::ConstantTime para Perl hasta la versión 0.321 es vulnerable a ataques de temporización que permiten a un atacante adivinar la longitud de una cadena secreta. Como se indica en la documentación: "Si las longitudes de las cadenas son diferentes, dado que `equals` devuelve `false` inmediatamente, el tamaño de la cadena secreta podría filtrarse (pero no su contenido). Esto es similar a CVE-2020-36829".

28 Mar 2025, 15:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

28 Mar 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-28 03:15

Updated : 2025-04-11 18:10

NVD link : CVE-2024-13939

Mitre link : CVE-2024-13939

CVE.ORG link : CVE-2024-13939

JSON object : View

Products Affected

fractal

  • string\
CWE
CWE-208

Observable Timing Discrepancy

CWE-203

Observable Discrepancy