http://bugzilla.opensuse.org/show_bug.cgi?id=1098368 Bug ID: 1098368 Summary: VUL-0: CVE-2018-12558: perl-Email-Address: DOS vulnerability in perl module Email::Address Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/208487/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: chris@computersalat.de Reporter: meissner@suse.com QA Contact: security-team@suse.de CC: dlovasko@suse.com Found By: Security Response Team Blocker: --- CVE-2018-12558 DOS in perl module Email::Address From: Pali Rohár <pali.rohar () gmail com> Date: Tue, 19 Jun 2018 20:06:04 +0200 Hello! Perl module Email::Address, also in the last version 1.909 is vulnerable to Algorithm Complexity problem and can cause Denial of Service when attacker prepares specially crafted input. Root of this problem is that parsing of email addresses in Email::Address module is done by regular expressions, which in perl can be exponential. The trivial input is 30 form-fields characters. You can test it with following oneliner: $ perl -MEmail::Address -E 'Email::Address->parse("\f" x 30)' Vulnerable are all applications which receive (untrusted) emails and parse address headers (From/To/Cc/...) by Email::Address module. Such application can be DOSed by sending email with 30 form-fields characters in From or To header. Note that this is not the only one problematic input, due to way how is Email::Address implemented it should be possible to prepare more non-trivial inputs. This problem was already reported to Debian Security Team and they suggested to ask MITRE for assigning CVE identifier. MITRE now assigned CVE-2018-12558. References: https://metacpan.org/pod/Email::Address https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901873 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12558 -- Pali Rohár pali.rohar () gmail com http://seclists.org/oss-sec/2018/q2/211 -- You are receiving this mail because: You are on the CC list for the bug.