The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - perl-Email-Address: denial of service when parsing crafted email address list (CVE-2015-7686)

  - perl-Email-Address: Specially crafted input could cause Denial of Service due to complex parse() method     (CVE-2018-12558)

  - The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression,     which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in     an RFC 2822 address. (CVE-2014-0477)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update fixes a denial of service vulnerability when parsing an empty quoted string (CVE-2014-0477)

Updated perl-Email-Address package fixes security vulnerability :

The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address (CVE-2014-0477).

The Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to backtracking into the phrase (CVE-2014-4720).

Update to 1.905 to fix CVE-2014-0477.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bastian Blank reported a denial of service vulnerability in Email::Address, a Perl module for RFC 2822 address parsing and creation. Email::Address::parse used significant time on parsing empty quoted strings. A remote attacker able to supply specifically crafted input to an application using Email::Address for parsing, could use this flaw to mount a denial of service attack against the application.

ID	Name	Product	Family	Severity
199632	RHEL 7 : perl-email-address (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
78720	openSUSE Security Update : perl-Email-Address (openSUSE-SU-2014:1328-1)	Nessus	SuSE Local Security Checks	medium
78018	Mandriva Linux Security Advisory : perl-Email-Address (MDVSA-2014:192)	Nessus	Mandriva Local Security Checks	medium
77947	Fedora 20 : perl-Email-Address-1.905-1.fc20 (2014-7613)	Nessus	Fedora Local Security Checks	medium
77946	Fedora 19 : perl-Email-Address-1.905-1.fc19 (2014-7610)	Nessus	Fedora Local Security Checks	medium
76286	Debian DSA-2969-1 : libemail-address-perl - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-0477

high

Tenable Plugins

high

medium

medium

medium

medium

medium