/ 
String-Compare-ConstantTime-0.320
River stage one • 3 direct dependents • 9 total dependents
⭐ Starred 8 GitHub stars
Security Advisories (1)
CVE-2024-13939 (2025-03-28)

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)." This is similar to CVE-2020-36829

Changes for version 0.320 - 2018-04-22

  • Added Travis and Appveyor testing (thanks Paul Cochrane)
  • Use warnings pragmas (thanks Paul Cochrane)
  • Many documentation and meta-data fixes/updates (thanks Paul Cochrane)
  • Better test coverage for strings with/without utf8 flag (thanks Paul Cochrane)
  • Replace SvCUR with sv_len_utf8 to work around issue in debugging versions of perl (see https://github.com/hoytech/String-Compare-ConstantTime/issues/4) (thanks Paul Cochrane)

Modules

String::Compare::ConstantTime
Timing side-channel protected string compare

Other files