Vulnerability · Published Mar 28, 2025 · Assigned by CPANSec
CVE-2024-13939String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string
High 7.5
In plain English
A high-severity security flaw in String::Compare::ConstantTime from FRACTAL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)." This is similar to CVE-2020-36829
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libstring-compare-constanttime-perl | no fix listed | DEBIAN-CVE-2024-13939 |
| Debian:13 | libstring-compare-constanttime-perl | 0.321-3 | DEBIAN-CVE-2024-13939 |
| Debian:14 | libstring-compare-constanttime-perl | 0.321-3 | DEBIAN-CVE-2024-13939 |
| Ubuntu:22.04:LTS | libstring-compare-constanttime-perl | no fix listed | UBUNTU-CVE-2024-13939 |
| Ubuntu:24.04:LTS | libstring-compare-constanttime-perl | no fix listed | UBUNTU-CVE-2024-13939 |
| Ubuntu:25.10 | libstring-compare-constanttime-perl | no fix listed | UBUNTU-CVE-2024-13939 |
| Ubuntu:26.04:LTS | libstring-compare-constanttime-perl | no fix listed | UBUNTU-CVE-2024-13939 |
| Ubuntu:26.10 | libstring-compare-constanttime-perl | no fix listed | UBUNTU-CVE-2024-13939 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FRACTAL | String::Compare::ConstantTime | 0 – through 0.321 |
Weakness: CWE-208 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N