| Name | CVE-2018-12558 |
| Description | The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters ("\f"). |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 901873 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| libemail-address-perl (PTS) | jessie | 1.905-2 | vulnerable |
| stretch | 1.908-1+deb9u1 | fixed |
| buster, bullseye | 1.912-1 | fixed |
| sid, trixie, bookworm | 1.913-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
Possibility of DoS vs. usability issue for Email::Address
https://github.com/Perl-Email-Project/Email-Address/issues/19
Mitigation: https://github.com/Perl-Email-Project/Email-Address/commit/aeaf0d7f1b0897b54cb246b8ac15d3ef177e5cae