Input validation error - CVE-2018-18898

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33038

Input validation error - CVE-2018-18898

Published: March 21, 2019 / Updated: August 3, 2020


Vulnerability identifier: #VU33038
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-18898
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.


Affected software

perl-email-address-list (Alpine package)
libemail-address-list-perl (Ubuntu package)
perl-Email-Address-List
WordPress Gallery Plugin - NextGEN Gallery
Ubuntu
Fedora

How to mitigate CVE-2018-18898

Install update from vendor's website.

libemail-address-list-perl (Ubuntu package) - addressed in versions 0.05-1+deb9u1build0.16.04.1, 0.05-1+deb9u1build0.18.04.1
perl-Email-Address-List - addressed in versions 0.06-1.fc28, 0.06-1.fc29

External References

Related Security Bulletins