https://bugzilla.redhat.com/show_bug.cgi?id=2355704
Bug ID: 2355704
Summary: CVE-2024-13939 perl-String-Compare-ConstantTime:
String::Compare::ConstantTime for Perl through 0.321
is vulnerable to timing attacks that allow an attacker
to guess the length of a secret string [fedora-40]
Product: Fedora
Version: 40
Status: NEW
Whiteboard: {"flaws": ["da725ec8-9b41-4a44-8936-c21c330ab0cf"]}
Component: perl-String-Compare-ConstantTime
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: ppisar(a)redhat.com
Reporter: ahanwate(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: jplesnik(a)redhat.com,
perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com
Blocks: 2355663
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2355663
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2355704
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2359384
Bug ID: 2359384
Summary: CVE-2025-2814 perl-Crypt-CBC: Crypt::CBC versions
between 1.21 and 3.04 for Perl may use insecure rand()
function for cryptographic functions [fedora-40]
Product: Fedora
Version: 40
Status: NEW
Whiteboard: {"flaws": ["5580521c-42e1-48db-811e-2609a67332d4"]}
Component: perl-Crypt-CBC
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: andreas(a)bawue.net
Reporter: ahanwate(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: andreas(a)bawue.net, paul(a)city-fan.org,
perl-devel(a)lists.fedoraproject.org
Blocks: 2359259
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2359259
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2359384
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…