CVE-2020-36829

2024-04-0700:00:00

mitre

github.com

mojolicious

perl

secure_compare

timing attacks

secret string

vulnerability

AI Score

6.7

Confidence

Low

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:*:*:*"
    ],
    "vendor": "mojolicious",
    "product": "mojolicious",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "8.65",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]