[Bug 1110723] New: CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse - perl-devel - Fedora Mailing-Lists

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

[Bug 1110723] New: CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

[Bug 1128978] New: perl-Plack:...

[Bug 1062424] CVE-2014-1875...

Red Hat Bugzilla

Wednesday, 18 June 2014 Wed, 18 Jun '14

5:41 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 Bug ID: 1110723 Summary: CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: perl-devel(a)lists.fedoraproject.org, rob.myers(a)gtri.gatech.edu, tcallawa(a)redhat.com It was discovered [1] that there's a denial of service vulnerability in Email::Address, a Perl module for RFC 2822 address parsing and creation[2]. Email::Address::parse uses significant time on parsing empty quoted string, as allowed by RFC 2822. Suggested fix was applied upstream as [3] contained in a new upstream version 1.905[4] which contain additional commits to avoid slowdowns. External References: [1] http://seclists.org/oss-sec/2014/q2/563 [2] https://metacpan.org/release/Email-Address [3] https://github.com/rjbs/Email-Address/commit/83f8306117115729ac9346523762... [4] https://github.com/rjbs/Email-Address/blob/master/Changes -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=O6OgIb7i9P&a=cc_unsubscribe

Reply

Show replies by thread

Red Hat Bugzilla

Wednesday, 18 June Wed, 18 Jun

5:42 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 Vasyl Kaigorodov <vkaigoro(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1110724 Depends On| |1110725 Depends On| |1110726 --- Comment #1 from Vasyl Kaigorodov <vkaigoro(a)redhat.com> --- Created perl-Email-Address tracking bugs for this issue: Affects: fedora-all [bug 1110724] Affects: epel-5 [bug 1110725] Affects: epel-6 [bug 1110726] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1110724 [Bug 1110724] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1110725 [Bug 1110725] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse [epel-5] https://bugzilla.redhat.com/show_bug.cgi?id=1110726 [Bug 1110726] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse [epel-6] -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=qlT5s9kVoW&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Friday, 20 June Fri, 20 Jun

10:49 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 --- Comment #2 from Vincent Danen <vdanen(a)redhat.com> --- External References: https://metacpan.org/release/RJBS/Email-Address-1.905 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=e0LHktICN6&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Monday, 7 July Mon, 7 Jul

1:18 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 Murray McAllister <mmcallis(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20140618, |impact=low,public=20140618, |reported=20140618,source=os |reported=20140618,source=os |s-sec,cvss2=2.1/AV:L/AC:L/A |s-sec,cvss2=2.1/AV:L/AC:L/A |u:N/C:N/I:N/A:P,fedora-all/ |u:N/C:N/I:N/A:P,rhel-7/perl |perl-Email-Address=affected |-Email-Address=affected,fed |,epel-5/perl-Email-Address= |ora-all/perl-Email-Address= |affected,epel-6/perl-Email- |affected,epel-5/perl-Email- |Address=affected |Address=affected,epel-6/per | |l-Email-Address=affected -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=hsWXgROmG1&a=cc_unsubscribe

Reply

Red Hat Bugzilla

1:19 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 Murray McAllister <mmcallis(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1116708 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=x9tpX65tDN&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Friday, 26 September Fri, 26 Sep

4 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 Bug 1110723 depends on bug 1110724, which changed state. Bug 1110724 Summary: CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1110724 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ydVxrdNvUh&a=cc_unsubscribe

Reply

Red Hat Bugzilla

4 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 --- Comment #3 from Fedora Update System <updates(a)fedoraproject.org> --- perl-Email-Address-1.905-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=t5eqfTdyCj&a=cc_unsubscribe

Reply

Red Hat Bugzilla

4:03 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 --- Comment #4 from Fedora Update System <updates(a)fedoraproject.org> --- perl-Email-Address-1.905-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=bE28HwdDf0&a=cc_unsubscribe

Reply

Red Hat Bugzilla

12:01 p.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 Bug 1110723 depends on bug 1110726, which changed state. Bug 1110726 Summary: CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1110726 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=prIa5dmcfK&a=cc_unsubscribe

Reply

Red Hat Bugzilla

12:01 p.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 --- Comment #5 from Fedora Update System <updates(a)fedoraproject.org> --- perl-Email-Address-1.905-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=UVjzjCSM5G&a=cc_unsubscribe

Reply

Red Hat Bugzilla

12:01 p.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 Bug 1110723 depends on bug 1110725, which changed state. Bug 1110725 Summary: CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse [epel-5] https://bugzilla.redhat.com/show_bug.cgi?id=1110725 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Uy8jGOaQLP&a=cc_unsubscribe

Reply

Red Hat Bugzilla

12:01 p.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 --- Comment #6 from Fedora Update System <updates(a)fedoraproject.org> --- perl-Email-Address-1.905-1.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=SWC3mQIPEt&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Tuesday, 20 January Tue, 20 Jan

11:02 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 --- Comment #7 from Vincent Danen <vdanen(a)redhat.com> --- Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=jyVPduu19c&a=cc_unsubscribe

Reply

Red Hat Bugzilla

11:02 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 Vincent Danen <vdanen(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20140618, |impact=low,public=20140618, |reported=20140618,source=os |reported=20140618,source=os |s-sec,cvss2=2.1/AV:L/AC:L/A |s-sec,cvss2=2.1/AV:L/AC:L/A |u:N/C:N/I:N/A:P,rhel-7/perl |u:N/C:N/I:N/A:P,rhel-7/perl |-Email-Address=affected,fed |-Email-Address=wontfix,fedo |ora-all/perl-Email-Address= |ra-all/perl-Email-Address=a |affected,epel-5/perl-Email- |ffected,epel-5/perl-Email-A |Address=affected,epel-6/per |ddress=affected,epel-6/perl |l-Email-Address=affected |-Email-Address=affected -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=pVXTuMvcxF&a=cc_unsubscribe

Reply

Red Hat Bugzilla

11:02 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 Vincent Danen <vdanen(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Last Closed| |2015-01-20 12:02:28 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ht9cwiLBh3&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Wednesday, 4 February Wed, 4 Feb

6:08 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 Martin Prpic <mprpic(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version|1.905 |perl-Email-Address 1.905 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=GkECjkWugA&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Friday, 31 July Fri, 31 Jul

2:22 a.m.

New subject: [Bug 1110723] CVE-2014-0477 perl-Email-Address: Denial-of-Service in Email::Address::parse

https://bugzilla.redhat.com/show_bug.cgi?id=1110723 Ján Rusnačko <jrusnack(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20140618, |impact=low,public=20140618, |reported=20140618,source=os |reported=20140618,source=os |s-sec,cvss2=2.1/AV:L/AC:L/A |s-security,cvss2=2.1/AV:L/A |u:N/C:N/I:N/A:P,rhel-7/perl |C:L/Au:N/C:N/I:N/A:P,rhel-7 |-Email-Address=wontfix,fedo |/perl-Email-Address=wontfix |ra-all/perl-Email-Address=a |,fedora-all/perl-Email-Addr |ffected,epel-5/perl-Email-A |ess=affected,epel-5/perl-Em |ddress=affected,epel-6/perl |ail-Address=affected,epel-6 |-Email-Address=affected |/perl-Email-Address=affecte | |d -- You are receiving this mail because: You are on the CC list for the bug.

Reply

3185

days inactive

3593

days old

perl-devel@lists.fedoraproject.org

Manage subscription

16 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla