CVE-2024-13939

Name	CVE-2024-13939
Description	String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)." This is similar to CVE-2020-36829
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1101502

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libstring-compare-constanttime-perl (PTS)	bullseye	0.321-1	vulnerable
	bookworm	0.321-2	vulnerable
	trixie, sid	0.321-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libstring-compare-constanttime-perl	source	(unstable)	0.321-3			1101502

Notes

[bookworm] - libstring-compare-constanttime-perl <no-dsa> (Minor issue)
https://lists.security.metacpan.org/cve-announce/msg/28284732/
https://metacpan.org/release/FRACTAL/String-Compare-ConstantTime-0.321/view/lib/String/Compare/ConstantTime.pm#TIMING-SIDE-CHANNEL
Disputed upstream:
https://github.com/hoytech/String-Compare-ConstantTime/pull/21