CVE Vulnerabilities

CVE-2018-12558

Inefficient Algorithmic Complexity

Published: Jun 20, 2018 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
LOW

The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters (f).

Weakness

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Affected Software

Name Vendor Start Version End Version
Email::address Email::address_module_project * 1.909 (including)
Libemail-address-perl Ubuntu artful *
Libemail-address-perl Ubuntu bionic *
Libemail-address-perl Ubuntu cosmic *
Libemail-address-perl Ubuntu esm-apps/bionic *
Libemail-address-perl Ubuntu esm-apps/xenial *
Libemail-address-perl Ubuntu trusty *
Libemail-address-perl Ubuntu upstream *
Libemail-address-perl Ubuntu xenial *

References