CVE-2024-13939: String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string
First published: Fri Mar 28 2025(Updated: )
String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)." This is similar to CVE-2020-36829
Credit: 9b29abf9-4ab0-4765-b253-1875cd9b441e
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Perl String::Compare::ConstantTime | <=0.321 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-13939?
CVE-2024-13939 is considered to have a high severity due to its potential for timing attacks.
What does CVE-2024-13939 affect?
CVE-2024-13939 affects Perl's String::Compare::ConstantTime versions up to and including 0.321.
How do I fix CVE-2024-13939?
To fix CVE-2024-13939, you should upgrade to a version of String::Compare::ConstantTime that is beyond 0.321.
What type of attack does CVE-2024-13939 allow?
CVE-2024-13939 allows timing attacks that enable attackers to guess the length of a secret string.
Is the timing attack in CVE-2024-13939 related to string comparison?
Yes, the timing attack in CVE-2024-13939 is specifically related to improper string comparison in the affected Perl module.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/event
- vendor/perl
- canonical/perl string::compare::constanttime