PT-2019-9665 · Best Practical+1 · Request Tracker+1

Publicado 2019-03-17 · Atualizado 2023-01-20 · CVE-2018-18898

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Best Practical Request Tracker versions 4.1.13 through 4.4

Description The issue concerns the email-ingestion feature, which is susceptible to a denial of service by remote attackers. This is achieved through an algorithmic complexity attack on email address parsing.

Recommendations For versions 4.1.13 through 4.4, consider disabling the email-ingestion feature as a temporary workaround until a patch is available.

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2018-18898

DLA-2101-1

USN-4517-1

Produtos afetados

Request Tracker

Ubuntu

Referências · 20

• https://github.com/bestpractical/email-address-list/commit/31bd4dc2dfb26fd6a17e4436df3d3c8904856f30 · Nota
• https://github.com/bestpractical/email-address-list/commit/a22e6b233443fe3ad1a408e50ecbd7237674817d · Nota
• https://github.com/bestpractical/email-address-list/commit/6dd5021a6e5df2e8c86a163dc2e180a76a38e63b · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPJVDT77ZPRU5Z2BEMZM7EBY6WZHUATZ · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-2101-1 · Aviso do Fabricante
• https://usn.ubuntu.com/4517-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-4517-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-18898 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-18898 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-18898 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18898 · Aviso do Fabricante
• https://osv.dev/vulnerability/ALPINE-CVE-2018-18898 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-18898 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18898 · Aviso do Fabricante