{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"High"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"perl-Mojolicious security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for perl-Mojolicious is now available for openEuler-22.03-LTS.",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology.\n\nSecurity Fix(es):\n\nThe Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.(CVE-2020-36829)\n\nThe Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.(CVE-2021-47208)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for perl-Mojolicious is now available for openEuler-22.03-LTS.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"High",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"perl-Mojolicious",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2024-1519",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1519"
			},
			{
				"summary":"CVE-2020-36829",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2020-36829&packageName=perl-Mojolicious"
			},
			{
				"summary":"CVE-2021-47208",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2021-47208&packageName=perl-Mojolicious"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36829"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47208"
			},
			{
				"summary":"openEuler-SA-2024-1519 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2024/csaf-openeuler-sa-2024-1519.json"
			}
		],
		"title":"An update for perl-Mojolicious is now available for openEuler-22.03-LTS",
		"tracking":{
			"initial_release_date":"2024-05-10T09:16:46+08:00",
			"revision_history":[
				{
					"date":"2024-05-10T09:16:46+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				},
				{
					"date":"2024-10-31T09:16:46+08:00",
					"summary":"final",
					"number":"2.0.0"
				}
			],
			"generator":{
				"date":"2024-10-31T09:16:46+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2024-10-31T09:16:46+08:00",
			"id":"openEuler-SA-2024-1519",
			"version":"2.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS"
									},
									"product_id":"openEuler-22.03-LTS",
									"name":"openEuler-22.03-LTS"
								},
								"name":"openEuler-22.03-LTS",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS"
									},
									"product_id":"perl-Test-Mojo-9.26-1.oe2203.noarch.rpm",
									"name":"perl-Test-Mojo-9.26-1.oe2203.noarch.rpm"
								},
								"name":"perl-Test-Mojo-9.26-1.oe2203.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS"
									},
									"product_id":"perl-Mojolicious-9.26-1.oe2203.noarch.rpm",
									"name":"perl-Mojolicious-9.26-1.oe2203.noarch.rpm"
								},
								"name":"perl-Mojolicious-9.26-1.oe2203.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS"
									},
									"product_id":"perl-Mojolicious-help-9.26-1.oe2203.noarch.rpm",
									"name":"perl-Mojolicious-help-9.26-1.oe2203.noarch.rpm"
								},
								"name":"perl-Mojolicious-help-9.26-1.oe2203.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS"
									},
									"product_id":"perl-Mojolicious-9.26-1.oe2203.src.rpm",
									"name":"perl-Mojolicious-9.26-1.oe2203.src.rpm"
								},
								"name":"perl-Mojolicious-9.26-1.oe2203.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-22.03-LTS",
				"product_reference":"perl-Test-Mojo-9.26-1.oe2203.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS:perl-Test-Mojo-9.26-1.oe2203.noarch",
					"name":"perl-Test-Mojo-9.26-1.oe2203.noarch as a component of openEuler-22.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS",
				"product_reference":"perl-Mojolicious-9.26-1.oe2203.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.noarch",
					"name":"perl-Mojolicious-9.26-1.oe2203.noarch as a component of openEuler-22.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS",
				"product_reference":"perl-Mojolicious-help-9.26-1.oe2203.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS:perl-Mojolicious-help-9.26-1.oe2203.noarch",
					"name":"perl-Mojolicious-help-9.26-1.oe2203.noarch as a component of openEuler-22.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS",
				"product_reference":"perl-Mojolicious-9.26-1.oe2203.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.src",
					"name":"perl-Mojolicious-9.26-1.oe2203.src as a component of openEuler-22.03-LTS"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2020-36829",
			"notes":[
				{
					"text":"The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-22.03-LTS:perl-Test-Mojo-9.26-1.oe2203.noarch",
					"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.noarch",
					"openEuler-22.03-LTS:perl-Mojolicious-help-9.26-1.oe2203.noarch",
					"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.src"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-22.03-LTS:perl-Test-Mojo-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-help-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.src"
					],
					"details":"perl-Mojolicious security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1519"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":7.5,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-22.03-LTS:perl-Test-Mojo-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-help-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.src"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2020-36829"
		},
		{
			"cve":"CVE-2021-47208",
			"notes":[
				{
					"text":"The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-22.03-LTS:perl-Test-Mojo-9.26-1.oe2203.noarch",
					"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.noarch",
					"openEuler-22.03-LTS:perl-Mojolicious-help-9.26-1.oe2203.noarch",
					"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.src"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-22.03-LTS:perl-Test-Mojo-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-help-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.src"
					],
					"details":"perl-Mojolicious security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1519"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":7.5,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
						"version":"3.1"
					},
					"products":[
						"openEuler-22.03-LTS:perl-Test-Mojo-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-help-9.26-1.oe2203.noarch",
						"openEuler-22.03-LTS:perl-Mojolicious-9.26-1.oe2203.src"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2021-47208"
		}
	]
}