CLD-440 Details

Other IDs this deficiency may be known by:

CVE ID	CVE-2018-12558 (nvd) (mitre) (debian) (archlinux) (red hat) (suse) (ubuntu)
Other ID(s)

Basic Information:

Affected Package(s)	perl
Deficiency Type	SECURITY
Date Created	2018-06-19 14:08:49
Date Last Modified	2018-06-21 11:10:20

Version Specific Information:

Cucumber 1.0 i686	waiting for upstream to publish patch
Cucumber 1.0 x86_64	waiting for upstream to publish patch

Cucumber 1.1 i686	waiting for upstream to publish patch
Cucumber 1.1 x86_64	waiting for upstream to publish patch

Details:

=================================== Overview ===================================

================================ Initial Report ================================

From https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901873:

Package: libemail-address-perl
Version: 1.909-1

Perl module Email::Address, also in the last version 1.909 is vulnerable
to Algorithm Complexity problem and can cause Denial of Service when
attacker prepares specially crafted input. Root of this problem is that
parsing of email addresses in Email::Address module is done by regular
expressions, which in perl can be exponential.

The trivial input is 30 form-fields characters. You can test it with
following oneliner:

$ perl -MEmail::Address -E 'Email::Address->parse("\f" x 30)'

Vulnerable are all applications which receive (untrusted) emails and
parse address headers (From/To/Cc/...) by Email::Address module. Such
application can be DOSed by sending email with 30 form-fields characters
in From or To header.

Note that this is not the only one problematic input, due to way how is
Email::Address implemented it should be possible to prepare more
non-trivial inputs.

This problem was already reported to Debian Security Team and they
suggested to ask MITRE for assigning CVE identifier. MITRE now assigned
CVE-2018-12558.

-- 
Pali Rohár
pali.rohar@gmail.com

================================= Our Analysis =================================

----- Affected Products -----

----- Scope and Impact of this Vulnerability -----

----- Testing if you are Affected -----

----- Fix for this Vulnerability -----

================================= Our Solution =================================