CVE-2018-18898
First published: Sun Mar 17 2019(Updated: )
The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/libemail-address-list-perl | 0.06-1 0.06-2 | |
| ubuntu/libemail-address-list-perl | <0.05-1+ | 0.05-1+ |
| ubuntu/libemail-address-list-perl | <0.06-1 | 0.06-1 |
| ubuntu/libemail-address-list-perl | <0.06-1 | 0.06-1 |
| ubuntu/libemail-address-list-perl | <0.06-1 | 0.06-1 |
| ubuntu/libemail-address-list-perl | <0.06-1 | 0.06-1 |
| ubuntu/libemail-address-list-perl | <0.05-1+ | 0.05-1+ |
| Bestpractical Request Tracker | >=4.1.13<=4.4.0 | |
| Fedoraproject Fedora | =28 | |
| Fedoraproject Fedora | =29 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bestpractical.com/download-page
- https://lists.debian.org/debian-lts-announce/2020/02/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CPJVDT77ZPRU5Z2BEMZM7EBY6WZHUATZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2/
- https://usn.ubuntu.com/4517-1/
- https://launchpad.net/bugs/cve/CVE-2018-18898
- https://github.com/bestpractical/email-address-list/commit/a22e6b233443fe3ad1a408e50ecbd7237674817d
- https://github.com/bestpractical/email-address-list/commit/6dd5021a6e5df2e8c86a163dc2e180a76a38e63b
- https://github.com/bestpractical/email-address-list/commit/31bd4dc2dfb26fd6a17e4436df3d3c8904856f30
- https://security-tracker.debian.org/tracker/CVE-2018-18898
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPJVDT77ZPRU5Z2BEMZM7EBY6WZHUATZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2/
- https://ubuntu.com/security/notices/USN-4517-1
- https://www.cve.org/CVERecord?id=CVE-2018-18898
- https://nvd.nist.gov/vuln/detail/CVE-2018-18898
- https://ubuntu.com/security/CVE-2018-18898
Frequently Asked Questions
What is CVE-2018-18898?
CVE-2018-18898 is a vulnerability in the email-ingestion feature of Best Practical Request Tracker, versions 4.1.13 through 4.4, that allows denial of service attacks.
How severe is CVE-2018-18898?
CVE-2018-18898 is considered a high severity vulnerability with a severity value of 7.5.
How can I fix CVE-2018-18898?
To fix CVE-2018-18898, you should update to a version of Best Practical Request Tracker that is not affected by the vulnerability.
Where can I find more information about CVE-2018-18898?
You can find more information about CVE-2018-18898 on the Best Practical website and the Fedora Project mailing list.
What is the Common Weakness Enumeration (CWE) associated with CVE-2018-18898?
The Common Weakness Enumeration (CWE) associated with CVE-2018-18898 is CWE-400.
- collector/nvd-index
- agent/type
- agent/author
- agent/softwarecombine
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/tags
- agent/event
- vendor/bestpractical
- canonical/bestpractical request tracker
- version/bestpractical request tracker/4.1.13
- version/bestpractical request tracker/4.4.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/28
- version/fedoraproject fedora/29
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- version/debian debian linux/10.0
- package-manager/debian
- package-manager/ubuntu