Source: libnet-oauth-perl Version: 0.32-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for libnet-oauth-perl. CVE-2026-75589[0]: | Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC- | SHA256 and PLAINTEXT signatures with a non-constant-time comparison | in verify. Each of the three compares the signature carried in the | message against the locally computed one with the eq operator, which | returns as soon as the two strings differ. The time taken to reject | a signature varies with the length of the matching prefix. RSA-SHA1 | is not affected, as it verifies through the RSA key object rather | than by comparing strings. A client that can submit messages and | time the replies may recover a valid signature one byte at a time | rather than searching the whole signature space. Under PLAINTEXT the | value compared against is the signature key itself, so the search | recovers consumer_secret and token_secret. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-75589 https://www.cve.org/CVERecord?id=CVE-2026-75589 [1] https://lists.security.metacpan.org/cve-announce/msg/42818763/ [2] https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-g8xr-69p3-gw56 [3] https://github.com/vurtdev/Net-OAuth/commit/a1a16b58add85668ef4fcda642a486ceed098eba Please adjust the affected versions in the BTS as needed. Regards, Salvatore
