CVE-2014-0477: Medium severity email\ \ vulnerability
It was discovered [1] that there's a denial of service vulnerability in Email::Address, a Perl module for RFC 2822 address parsing and creation [2]. Email::Address::parse uses significant time on parsing empty quoted string, as allowed by RFC 2822.
Suggested fix was applied upstream as [3] contained in a new upstream version 1.905 [4] which contain additional commits [5] to avoid slowdowns.
[1] http://seclists.org/oss-sec/2014/q2/563 [2] https://metacpan.org/release/Email-Address [3] https://github.com/rjbs/Email-Address/commit/83f8306 [4] https://metacpan.org/release/RJBS/Email-Address-1.905 [5] https://github.com/rjbs/Email-Address/blob/432d10e/Changes
Other sources
The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0477?
CVE-2014-0477 is classified as a denial of service vulnerability in the Email::Address Perl module.
How do I fix CVE-2014-0477?
To fix CVE-2014-0477, upgrade the Email::Address module to version 1.905 or later.
What versions are affected by CVE-2014-0477?
CVE-2014-0477 affects versions of the Email::Address Perl module up to and including 1.904.
What is the nature of the vulnerability in CVE-2014-0477?
CVE-2014-0477 exploits the Email::Address::parse function, causing significant delays when parsing empty quoted strings.
Is there a workaround for CVE-2014-0477 if I cannot update?
If unable to update, avoid using the Email::Address::parse function with empty quoted strings as inputs.