CVE-2024-13939

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-13939
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-13939.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-13939
Downstream
Published
2025-03-28T02:05:01.416Z
Modified
2026-05-18T05:56:00.971251688Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string
Details

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)."

This is similar to CVE-2020-36829

Database specific 
{
    "cna_assigner": "CPANSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13939.json",
    "cwe_ids": [
        "CWE-208"
    ]
}
References

Affected packages

Git / github.com/hoytech/string-compare-constanttime

Affected ranges

Type
GIT
Repo
https://github.com/hoytech/string-compare-constanttime
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
51d7d7832bc45523fb97447d137a54d5b2fe949e
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.321"
        }
    ]
}

Affected versions

String-Compare-ConstantTime-0.*
String-Compare-ConstantTime-0.20
String-Compare-ConstantTime-0.300
String-Compare-ConstantTime-0.310
String-Compare-ConstantTime-0.311
String-Compare-ConstantTime-0.312
String-Compare-ConstantTime-0.320
String-Compare-ConstantTime-0.321

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-13939.json"