Vulnerability Name:

CVE-2014-0477 (CCN-93874)

Assigned:2013-12-19
Published:2014-06-18
Updated:2015-11-04
Summary:The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.

CWE-185: CWE-185: Incorrect Regular Expression
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2014-0477

Source: CCN
Type: CPAN Web site
Email::Address Module for Perl

Source: CCN
Type: OSS Security, Wed, 18 Jun 2014 07:19:15 +0200
CVE-2014-0477: Email::Address: Denial-of-Service in Email::Address::parse

Source: MLIST
Type: UNKNOWN
[oss-security] 20140618 CVE-2014-0477: Email::Address: Denial-of-Service in Email::Address::parse

Source: SECUNIA
Type: UNKNOWN
59212

Source: SECUNIA
Type: UNKNOWN
59333

Source: SECUNIA
Type: UNKNOWN
61981

Source: DEBIAN
Type: UNKNOWN
DSA-2969

Source: CCN
Type: OSVDB ID: 108242
Email::Address Module for Perl /lib/Email/Address.pm Empty Quoted String Parsing Remote DoS

Source: CCN
Type: BID-68084
Perl 'Email::Address' Module Local Denial of Service Vulnerability

Source: MISC
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=1110723

Source: XF
Type: UNKNOWN
email-address-cve20140477-dos(93874)

Source: CONFIRM
Type: UNKNOWN
https://github.com/rjbs/Email-Address/blob/master/Changes

Source: CONFIRM
Type: Exploit, Patch
https://github.com/rjbs/Email-Address/commit/83f8306117115729ac9346523762c0c396251eb5

Source: CONFIRM
Type: UNKNOWN
https://metacpan.org/release/RJBS/Email-Address-1.905

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-0477

Vulnerable Configuration:Configuration 1:
  • cpe:/a:email::address_module_project:email::address:1.1:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.2:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.3:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.5:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.6:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.7:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.80:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.85:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.86:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.870:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.871:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.880:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.881:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.882:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.883:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.884:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.885:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.886:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.887:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.888:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.889:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.890:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.891:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.892:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.893:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.894:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.895:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.896:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.897:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.898:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.899:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.900:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.901:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.902:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:1.903:*:*:*:*:perl:*:*
  • OR cpe:/a:email::address_module_project:email::address:*:*:*:*:*:perl:*:* (Version <= 1.904)
  • OR cpe:/o:fedoraproject:fedora:*:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20140477
    V
    CVE-2014-0477
    2022-06-30
    oval:org.opensuse.security:def:113115
    P
    perl-Email-Address-1.908-1.3 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106550
    P
    perl-Email-Address-1.908-1.3 on GA media (Moderate)
    2021-10-01
    oval:org.mitre.oval:def:24401
    P
    DSA-2969-1 libemail-address-perl - security update
    2014-08-11
    oval:com.ubuntu.artful:def:20140477000
    V
    CVE-2014-0477 on Ubuntu 17.10 (artful) - low.
    2014-07-03
    oval:com.ubuntu.disco:def:201404770000000
    V
    CVE-2014-0477 on Ubuntu 19.04 (disco) - low.
    2014-07-03
    oval:com.ubuntu.trusty:def:20140477000
    V
    CVE-2014-0477 on Ubuntu 14.04 LTS (trusty) - low.
    2014-07-03
    oval:com.ubuntu.cosmic:def:201404770000000
    V
    CVE-2014-0477 on Ubuntu 18.10 (cosmic) - low.
    2014-07-03
    oval:com.ubuntu.bionic:def:20140477000
    V
    CVE-2014-0477 on Ubuntu 18.04 LTS (bionic) - low.
    2014-07-03
    oval:com.ubuntu.xenial:def:20140477000
    V
    CVE-2014-0477 on Ubuntu 16.04 LTS (xenial) - low.
    2014-07-03
    oval:com.ubuntu.bionic:def:201404770000000
    V
    CVE-2014-0477 on Ubuntu 18.04 LTS (bionic) - low.
    2014-07-03
    oval:com.ubuntu.cosmic:def:20140477000
    V
    CVE-2014-0477 on Ubuntu 18.10 (cosmic) - low.
    2014-07-03
    oval:com.ubuntu.xenial:def:201404770000000
    V
    CVE-2014-0477 on Ubuntu 16.04 LTS (xenial) - low.
    2014-07-03
    oval:com.ubuntu.precise:def:20140477000
    V
    CVE-2014-0477 on Ubuntu 12.04 LTS (precise) - low.
    2014-07-03
    BACK
    email::address_module_project email::address 1.1
    email::address_module_project email::address 1.2
    email::address_module_project email::address 1.3
    email::address_module_project email::address 1.5
    email::address_module_project email::address 1.6
    email::address_module_project email::address 1.7
    email::address_module_project email::address 1.80
    email::address_module_project email::address 1.85
    email::address_module_project email::address 1.86
    email::address_module_project email::address 1.870
    email::address_module_project email::address 1.871
    email::address_module_project email::address 1.880
    email::address_module_project email::address 1.881
    email::address_module_project email::address 1.882
    email::address_module_project email::address 1.883
    email::address_module_project email::address 1.884
    email::address_module_project email::address 1.885
    email::address_module_project email::address 1.886
    email::address_module_project email::address 1.887
    email::address_module_project email::address 1.888
    email::address_module_project email::address 1.889
    email::address_module_project email::address 1.890
    email::address_module_project email::address 1.891
    email::address_module_project email::address 1.892
    email::address_module_project email::address 1.893
    email::address_module_project email::address 1.894
    email::address_module_project email::address 1.895
    email::address_module_project email::address 1.896
    email::address_module_project email::address 1.897
    email::address_module_project email::address 1.898
    email::address_module_project email::address 1.899
    email::address_module_project email::address 1.900
    email::address_module_project email::address 1.901
    email::address_module_project email::address 1.902
    email::address_module_project email::address 1.903
    email::address_module_project email::address *
    fedoraproject fedora *