PT-2014-3647 · Perl · Email::Address

Bastian Blank · Published 2014-07-03 · Updated 2024-06-15 · CVE-2014-0477

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Email::Address module versions prior to 1.905

Description The issue concerns the parse function in the Email::Address module, which uses an inefficient regular expression. This inefficiency can be exploited by remote attackers to cause a denial of service through excessive CPU consumption. The attack can be initiated by sending an empty quoted string in an RFC 2822 address.

Recommendations For versions prior to 1.905, update to version 1.905 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2014-0477

DLA-0011-1

DSA-2969-1

MGASA-2014-0389

OPENSUSE-SU-2024:10452-1

Affected Products

Email::Address

References · 22

• 🔥 https://github.com/rjbs/Email-Address/commit/83f8306117115729ac9346523762c0c396251eb5 · Exploit
• https://osv.dev/vulnerability/MGASA-2014-0389 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0477 · Vendor Advisory
• https://debian.org/security/2014/dsa-2969 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0389.html · Security Note
• https://cve.org/CVERecord?id=CVE-2014-0477 · Security Note
• https://ubuntu.com/security/CVE-2014-0477 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-0477 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0477 · Security Note
• http://debian.org/security/2014/dsa-2969 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10452-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0477 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0477 · Vendor Advisory
• https://github.com/rjbs/Email-Address/blob/master/Changes · Note
• http://secunia.com/advisories/59333 · Note