Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service (CPU consumption) via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associated with nested comments. NOTE: the default configuration in 1.908 mitigates this vulnerability but misparses certain realistic comments.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - perl-Email-Address: denial of service when parsing crafted email address list (CVE-2015-7686)

  - perl-Email-Address: Specially crafted input could cause Denial of Service due to complex parse() method     (CVE-2018-12558)

  - The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression,     which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in     an RFC 2822 address. (CVE-2014-0477)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the perl-Email-Address package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Algorithmic complexity vulnerability in Address.pm in     the Email-Address module 1.908 and earlier for Perl     allows remote attackers to cause a denial of service     (CPU consumption) via a crafted string containing a     list of e-mail addresses in conjunction with     parenthesis characters that can be associated with     nested comments. NOTE: the default configuration in     1.908 mitigates this vulnerability but misparses     certain realistic comments.(CVE-2015-7686)

  - The parse() method in the Email::Address module through     1.909 for Perl is vulnerable to Algorithmic complexity     on specially prepared input, leading to Denial of     Service. Prepared special input that caused this     problem contained 30 form-field characters     ('\f').(CVE-2018-12558)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.912, fixes CVE-2015-7686 and CVE-2018-12558.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

BestPractical reports :

Please reference CVE/URL list for details

ID	Name	Product	Family	Severity
199632	RHEL 7 : perl-email-address (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
140871	EulerOS 2.0 SP3 : perl-Email-Address (EulerOS-SA-2020-2104)	Nessus	Huawei Local Security Checks	high
121238	Fedora 28 : perl-Email-Address (2019-8deebad756)	Nessus	Fedora Local Security Checks	high
121235	Fedora 29 : perl-Email-Address (2019-026d5ab23d)	Nessus	Fedora Local Security Checks	high
100827	FreeBSD : rt and dependent modules -- multiple security vulnerabilities (7a92e958-5207-11e7-8d7c-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-7686

high

Tenable Plugins

high

high

high

high

high