The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters (f).
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Email::address | Email::address_module_project | * | 1.909 (including) |
| Libemail-address-perl | Ubuntu | artful | * |
| Libemail-address-perl | Ubuntu | bionic | * |
| Libemail-address-perl | Ubuntu | cosmic | * |
| Libemail-address-perl | Ubuntu | esm-apps/bionic | * |
| Libemail-address-perl | Ubuntu | esm-apps/xenial | * |
| Libemail-address-perl | Ubuntu | trusty | * |
| Libemail-address-perl | Ubuntu | upstream | * |
| Libemail-address-perl | Ubuntu | xenial | * |