String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)." This is similar to CVE-2020-36829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an     attacker to guess the length of a secret string. As stated in the documentation: If the lengths of the     strings are different, because equals returns false right away the size of the secret string may be leaked     (but not its contents). This is similar to CVE-2020-36829 (CVE-2024-13939)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ce51c124a5 advisory.

    This release fixes CVE-2024-13939 (leaking the length of a secret string)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e6f5710dba advisory.

    This release fixes CVE-2024-13939 (leaking the length of a secret string)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-5d61874568 advisory.

    This release fixes CVE-2024-13939 (leaking the length of a secret string)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
256128	Linux Distros Unpatched Vulnerability : CVE-2024-13939	Nessus	Misc.	high
240756	Fedora 42 : perl-String-Compare-ConstantTime (2025-ce51c124a5)	Nessus	Fedora Local Security Checks	high
234591	Fedora 40 : perl-String-Compare-ConstantTime (2025-e6f5710dba)	Nessus	Fedora Local Security Checks	high
234587	Fedora 41 : perl-String-Compare-ConstantTime (2025-5d61874568)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2024-13939

high

Tenable Plugins

high

high

high

high