Bug 1593318 (CVE-2018-12558)

Summary: CVE-2018-12558 perl-Email-Address: Specially crafted input could cause Denial of Service due to complex parse() method
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: jose.p.oliveira.oss, perl-devel, perl-maint-list, ppisar, rob.myers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-25 09:45:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1593319, 1593320, 1593321, 1601806    
Bug Blocks: 1593323    

Description Andrej Nemec 2018-06-20 14:35:18 UTC
The parse() method in the Email::Address module through 1.909 for Perl can consume a large amount of resources on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters ("\f").



Comment 1 Andrej Nemec 2018-06-20 14:36:00 UTC
Created perl-Email-Address tracking bugs for this issue:

Affects: epel-6 [bug 1593320]
Affects: fedora-all [bug 1593319]

Comment 4 Tomas Hoger 2018-07-17 10:22:43 UTC
Upstream bug:


Comment 6 Petr Pisar 2019-01-03 10:19:22 UTC
Email-Address-1.910 (1.911 and 1.912 updates a documentation) fixes this vulnerability by extensive use of independent subexpressions ("(?>pattern)" constructs) that prevents from undesired backtracking. An excerpt from the fix:

-my $cfws           = qr/$comment|\s+/;
+my $cfws           = qr/$comment|(?>\s+)/;

The exponential backtracking is the cause of this vulnerability and is indeed fixed:

[test@fedora-30 Email-Address-1.912]$ time perl -Ilib -e 'use Email::Address; Email::Address->parse("\f" x 30)'

real    0m0.017s
user    0m0.010s
sys     0m0.007s