CVE-2020-36829 Information disclosure in n/a
An attacker can guess the length of a secret string via timing attacks in the Mojolicious Perl module, potentially exposing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36829?
CVE-2020-36829 is a high-severity vulnerability in n/a, published on 7 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.
Which versions are affected by CVE-2020-36829?
How do I fix CVE-2020-36829?
Upgrade to a fixed version.
Is CVE-2020-36829 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36829 exists.
Sources
Also known as AZL-43936, AZL-45018, DEBIAN-CVE-2020-36829, DLA-3846-1, GHSA-jx7f-v5r5-55j4, UBUNTU-CVE-2020-36829.