CVE catalog

CVE-2024-13939

libstring-compare-constanttime-perl: CVE-2024-13939

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.38% · Oct 25, 2026

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)." This is similar to CVE-2020-36829

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibstring-compare-constanttime-perlsid0.321-3fixed
Debianlibstring-compare-constanttime-perlforky0.321-3fixed
Debianlibstring-compare-constanttime-perltrixie0.321-3fixed
Debianlibstring-compare-constanttime-perlbookworm0.321-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibstring-compare-constanttime-perlsourcesid0.321-3not yet assignedNot reported[1101502]
Debianlibstring-compare-constanttime-perlsourceforky0.321-3not yet assignedNot reported[1101502]
Debianlibstring-compare-constanttime-perlsourcetrixie0.321-3not yet assignedNot reported[1101502]
Debianlibstring-compare-constanttime-perlsourcebookworm(unfixed)not yet assignedNot reported[1101502]

[Debian bug #1101502]

Notes

[bookworm] libstring-compare-constanttime-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libstring-compare-constanttime-perl]Affected

    Source package: [libstring-compare-constanttime-perl]

    Details (2)

    • 0.321-2+b1 · amd64 · bookworm

      Affected

      dsa · libstring-compare-constanttime-perl · debian · bookworm; dsa · libstring-compare-constanttime-perl · debian · 12

    • 0.321-2+b1 · arm64 · bookworm

      Affected

      dsa · libstring-compare-constanttime-perl · debian · bookworm; dsa · libstring-compare-constanttime-perl · debian · 12

[Debian 13 (Trixie)]

  • [libstring-compare-constanttime-perl]Fixed
    Details (2)

    • 0.321-3 · amd64 · trixie

      Fixed · Fixed: 0.321-3

      dsa · libstring-compare-constanttime-perl · debian · 13

    • 0.321-3 · arm64 · trixie

      Fixed · Fixed: 0.321-3

      dsa · libstring-compare-constanttime-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]