https://bugzilla.redhat.com/show_bug.cgi?id=2519562
Bug ID: 2519562
Summary: CVE-2026-75589 perl-Net-OAuth: Net::OAuth: Information
disclosure via timing attack in signature verification
[epel-all]
Product: Fedora EPEL
Version: epel10
Status: NEW
Whiteboard: {"flaws": ["a78fe79b-0e97-4f6b-bb89-38c6f62932e7"]}
Component: perl-Net-OAuth
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected],
[email protected], [email protected]
Blocks: 2519409
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and
PLAINTEXT signatures with a non-constant-time comparison in verify.
Each of the three compares the signature carried in the message against the
locally computed one with the eq operator, which returns as soon as the two
strings differ. The time taken to reject a signature varies with the length of
the matching prefix. RSA-SHA1 is not affected, as it verifies through the RSA
key object rather than by comparing strings.
A client that can submit messages and time the replies may recover a valid
signature one byte at a time rather than searching the whole signature space.
Under PLAINTEXT the value compared against is the signature key itself, so the
search recovers consumer_secret and token_secret.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2519562
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202519562%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
