OESA-2024-1519

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1519

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2024-1519.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2024-1519

Upstream

CVE-2020-36829

CVE-2021-47208

Published

2024-05-10T11:07:52Z

Modified

2025-08-12T05:34:56.103347Z

Summary

perl-Mojolicious security update

Details

Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology.

Security Fix(es):

The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.(CVE-2020-36829)

The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.(CVE-2021-47208)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:22.03-LTS / perl-Mojolicious

Package

Name: perl-Mojolicious
Purl: pkg:rpm/openEuler/perl-Mojolicious&distro=openEuler-22.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.26-1.oe2203

Ecosystem specific

{
    "src": [
        "perl-Mojolicious-9.26-1.oe2203.src.rpm"
    ],
    "noarch": [
        "perl-Test-Mojo-9.26-1.oe2203.noarch.rpm",
        "perl-Mojolicious-9.26-1.oe2203.noarch.rpm",
        "perl-Mojolicious-help-9.26-1.oe2203.noarch.rpm"
    ]
}