The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters ("\f").

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic
    complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused
    this problem contained 30 form-field characters ("\f"). (CVE-2018-12558)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic     complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused     this problem contained 30 form-field characters (\f). (CVE-2018-12558)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the perl-Email-Address package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Algorithmic complexity vulnerability in Address.pm in     the Email-Address module 1.908 and earlier for Perl     allows remote attackers to cause a denial of service     (CPU consumption) via a crafted string containing a     list of e-mail addresses in conjunction with     parenthesis characters that can be associated with     nested comments. NOTE: the default configuration in     1.908 mitigates this vulnerability but misparses     certain realistic comments.(CVE-2015-7686)

  - The parse() method in the Email::Address module through     1.909 for Perl is vulnerable to Algorithmic complexity     on specially prepared input, leading to Denial of     Service. Prepared special input that caused this     problem contained 30 form-field characters     ('\f').(CVE-2018-12558)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-Email-Address to version 1.912 fixes the following issue :

Security issue fixed :

  - CVE-2018-12558: Fixed a vulnerability which could allow     Denial of Service in perl module Email::Address     (bsc#1098368).

Update to 1.912, fixes CVE-2015-7686 and CVE-2018-12558.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
424346	Alpine: multiple perl-email-address packages: security update to 1.912-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424346	Alpine: multiple perl-email-address packages: security update to 1.912-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
222077	Linux Distros Unpatched Vulnerability : CVE-2018-12558	Nessus	Misc.	high
140871	EulerOS 2.0 SP3 : perl-Email-Address (EulerOS-SA-2020-2104)	Nessus	Huawei Local Security Checks	high
123661	openSUSE Security Update : perl-Email-Address (openSUSE-2019-1114)	Nessus	SuSE Local Security Checks	high
121238	Fedora 28 : perl-Email-Address (2019-8deebad756)	Nessus	Fedora Local Security Checks	high
121235	Fedora 29 : perl-Email-Address (2019-026d5ab23d)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-12558

high

Tenable Plugins

high

high

high

high

high

high

high