CVE-2024-13939
HIGHDescription
String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)." This is similar to CVE-2020-36829
Is your site exposed to CVE-2024-13939?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| fractal | string\ |
References
Frequently Asked Questions
What is CVE-2024-13939? +
How severe is CVE-2024-13939? +
What products are affected by CVE-2024-13939? +
How do I check if I'm vulnerable to CVE-2024-13939? +
Related Vulnerabilities
SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) …
Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed …
An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash …
In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the …
An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash …
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, …