The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4517-1 advisory.

    It was discovered that Email-Address-List does not properly parse email

    addresses during email-ingestion. A remote attacker could use this issue to cause an algorithmic     complexity attack, resulting in a denial of

    service. (CVE-2018-18898)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An denial of service via an algorithmic complexity attack on email address parsing have been identified in libemail-address-list-perl.

For Debian 8 'Jessie', this problem has been fixed in version 0.05-1+deb8u1.

We recommend that you upgrade your libemail-address-list-perl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upstream bugfix. CVE-2018-18898

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Best PRactical Solutions reports :

0.06 2019-01-02

- Changes to address CVE-2018-18898 which could allow DDoS-type attacks. Thanks to Lukas Kramer for reporting the issue and Alex Vandiver for contributing fixes. - Fix pathological backtracking for unkown regex - Fix pathological backtracking in obs-phrase(i.e.
obs-display-name) - Fix pathological backtracking in cfws, quoted strings

ID	Name	Product	Family	Severity
140652	Ubuntu 16.04 LTS / 18.04 LTS : Email-Address-List vulnerability (USN-4517-1)	Nessus	Ubuntu Local Security Checks	high
133656	Debian DLA-2101-1 : libemail-address-list-perl security update	Nessus	Debian Local Security Checks	high
122137	Fedora 28 : perl-Email-Address-List (2019-ef5551fcff)	Nessus	Fedora Local Security Checks	high
122135	Fedora 29 : perl-Email-Address-List (2019-73cbc02e14)	Nessus	Fedora Local Security Checks	high
121521	FreeBSD : p5-Email-Address-List -- DDoS related vulnerability (22b90fe6-258e-11e9-9c8d-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-18898

high

Tenable Plugins

high

high

high

high

high