PT-2014-3647 · Perl · Email::Address

Bastian Blank · Publicado 2014-07-03 · Atualizado 2024-06-15 · CVE-2014-0477

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Email::Address module versions prior to 1.905

Description The issue concerns the parse function in the Email::Address module, which uses an inefficient regular expression. This inefficiency can be exploited by remote attackers to cause a denial of service through excessive CPU consumption. The attack can be initiated by sending an empty quoted string in an RFC 2822 address.

Recommendations For versions prior to 1.905, update to version 1.905 or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2014-0477

DLA-0011-1

DSA-2969-1

MGASA-2014-0389

OPENSUSE-SU-2024:10452-1

Produtos afetados

Email::Address

Referências · 22

• 🔥 https://github.com/rjbs/Email-Address/commit/83f8306117115729ac9346523762c0c396251eb5 · Exploit
• https://github.com/rjbs/Email-Address/blob/master/Changes · Nota
• http://secunia.com/advisories/59333 · Nota
• https://osv.dev/vulnerability/MGASA-2014-0389 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-0477 · Aviso do Fabricante
• https://debian.org/security/2014/dsa-2969 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0389.html · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2014-0477 · Nota de Segurança
• http://seclists.org/oss-sec/2014/q2/563 · Nota
• https://ubuntu.com/security/CVE-2014-0477 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=13541 · Nota
• https://osv.dev/vulnerability/CVE-2014-0477 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-0477 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0477 · Nota de Segurança
• http://debian.org/security/2014/dsa-2969 · Aviso do Fabricante