CVE-2020-36829

2024-04-0800:15:07

Debian Security Bug Tracker

security-tracker.debian.org

mojolicious

secure_compare timing attack

perl

vulnerability

version 1.74

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.

OSVersionArchitecturePackageVersionFilename
Debian12alllibmojolicious-perl< 8.65+dfsg-1libmojolicious-perl_8.65+dfsg-1_all.deb
Debian11alllibmojolicious-perl< 8.65+dfsg-1libmojolicious-perl_8.65+dfsg-1_all.deb
Debian10alllibmojolicious-perl< 8.12+dfsg-1.1~deb10u1libmojolicious-perl_8.12+dfsg-1.1~deb10u1_all.deb
Debian999alllibmojolicious-perl< 8.65+dfsg-1libmojolicious-perl_8.65+dfsg-1_all.deb
Debian13alllibmojolicious-perl< 8.65+dfsg-1libmojolicious-perl_8.65+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	libmojolicious-perl	< 8.65+dfsg-1	libmojolicious-perl_8.65+dfsg-1_all.deb
Debian	11	all	libmojolicious-perl	< 8.65+dfsg-1	libmojolicious-perl_8.65+dfsg-1_all.deb
Debian	10	all	libmojolicious-perl	< 8.12+dfsg-1.1~deb10u1	libmojolicious-perl_8.12+dfsg-1.1~deb10u1_all.deb
Debian	999	all	libmojolicious-perl	< 8.65+dfsg-1	libmojolicious-perl_8.65+dfsg-1_all.deb
Debian	13	all	libmojolicious-perl	< 8.65+dfsg-1	libmojolicious-perl_8.65+dfsg-1_all.deb