An update for perl-Mojolicious is now available for openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2024-1518 Final 1.0 1.0 2024-05-10 Initial 2024-05-10 2024-05-10 openEuler SA Tool V1.0 2024-05-10 perl-Mojolicious security update An update for perl-Mojolicious is now available for openEuler-20.03-LTS-SP4. Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology. Security Fix(es): The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.(CVE-2020-36829) The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.(CVE-2021-47208) An update for perl-Mojolicious is now available for openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High perl-Mojolicious https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1518 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2020-36829 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2021-47208 https://nvd.nist.gov/vuln/detail/CVE-2020-36829 https://nvd.nist.gov/vuln/detail/CVE-2021-47208 openEuler-20.03-LTS-SP4 perl-Mojolicious-9.26-1.oe2003sp4.noarch.rpm perl-Mojolicious-help-9.26-1.oe2003sp4.noarch.rpm perl-Test-Mojo-9.26-1.oe2003sp4.noarch.rpm perl-Mojolicious-9.26-1.oe2003sp4.src.rpm The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected. 2024-05-10 CVE-2020-36829 openEuler-20.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N perl-Mojolicious security update 2024-05-10 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1518 The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service. 2024-05-10 CVE-2021-47208 openEuler-20.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H perl-Mojolicious security update 2024-05-10 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1518