PT-2019-9665 · Best Practical+1 · Request Tracker+1

Published 2019-03-17 · Updated 2023-01-20 · CVE-2018-18898

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Best Practical Request Tracker versions 4.1.13 through 4.4

Description The issue concerns the email-ingestion feature, which is susceptible to a denial of service by remote attackers. This is achieved through an algorithmic complexity attack on email address parsing.

Recommendations For versions 4.1.13 through 4.4, consider disabling the email-ingestion feature as a temporary workaround until a patch is available.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2018-18898

DLA-2101-1

USN-4517-1

Affected Products

Request Tracker

Ubuntu

References · 20

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPJVDT77ZPRU5Z2BEMZM7EBY6WZHUATZ · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2101-1 · Vendor Advisory
• https://usn.ubuntu.com/4517-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4517-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-18898 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18898 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-18898 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18898 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-18898 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18898 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18898 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4517-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18898 · Security Note
• https://github.com/bestpractical/email-address-list/commit/31bd4dc2dfb26fd6a17e4436df3d3c8904856f30 · Note