14 lines
1.2 KiB
JSON
14 lines
1.2 KiB
JSON
{
|
|
"id": "openEuler-SA-2024-1519",
|
|
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1519",
|
|
"title": "An update for perl-Mojolicious is now available for openEuler-22.03-LTS",
|
|
"severity": "Important",
|
|
"description": "Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology.\r\n\r\nSecurity Fix(es):\r\n\r\nThe Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.(CVE-2020-36829)\r\n\r\nThe Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.(CVE-2021-47208)",
|
|
"cves": [
|
|
{
|
|
"id": "CVE-2021-47208",
|
|
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47208",
|
|
"severity": "Important"
|
|
}
|
|
]
|
|
} |