Vulnerability CVE-2014-4720

Vulnerability Name:

CVE-2014-4720 (CCN-94409)

Assigned:

2014-06-18

Published:

2014-06-18

Updated:

2014-07-07

Summary:

Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to "backtracking into the phrase," a different vulnerability than CVE-2014-0477.

CWE-185: CWE-185: Incorrect Regular Expression

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-Other

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2014-4720

Source: CCN
Type: CPAN Web site
Email::Address Module for Perl

Source: CCN
Type: OSS Security, Wed, 18 Jun 2014 07:19:15 +0200
CVE-2014-0477: Email::Address: Denial-of-Service in Email::Address::parse

Source: MLIST
Type: UNKNOWN
[oss-security] 20140614 CVE-2014-0477: Email::Address: Denial-of-Service in Email::Address::parse

Source: CCN
Type: BID-68446
Perl 'Email::Address' Module CVE-2014-4720 Denial of Service Vulnerability

Source: XF
Type: UNKNOWN
email-address-cve20144720-dos(94409)

Source: CONFIRM
Type: UNKNOWN
https://github.com/rjbs/Email-Address/blob/master/Changes

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-4720

Vulnerable Configuration:

Configuration 1:

cpe:/a:email::address_module_project:email::address:1.1:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.2:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.3:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.5:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.6:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.7:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.80:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.85:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.86:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.870:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.871:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.880:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.881:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.882:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.883:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.884:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.885:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.886:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.887:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.888:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.889:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.890:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.891:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.892:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.893:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.894:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.895:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.896:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.897:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.898:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.899:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.900:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.901:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:1.902:*:*:*:*:perl:*:*

OR cpe:/a:email::address_module_project:email::address:*:*:*:*:*:perl:*:* (Version <= 1.903)

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.bionic:def:201447200000000	V	CVE-2014-4720 on Ubuntu 18.04 LTS (bionic) - low.	2014-07-06
oval:com.ubuntu.artful:def:20144720000	V	CVE-2014-4720 on Ubuntu 17.10 (artful) - low.	2014-07-06
oval:com.ubuntu.trusty:def:20144720000	V	CVE-2014-4720 on Ubuntu 14.04 LTS (trusty) - low.	2014-07-06
oval:com.ubuntu.xenial:def:201447200000000	V	CVE-2014-4720 on Ubuntu 16.04 LTS (xenial) - low.	2014-07-06
oval:com.ubuntu.bionic:def:20144720000	V	CVE-2014-4720 on Ubuntu 18.04 LTS (bionic) - low.	2014-07-06
oval:com.ubuntu.xenial:def:20144720000	V	CVE-2014-4720 on Ubuntu 16.04 LTS (xenial) - low.	2014-07-06
oval:com.ubuntu.disco:def:201447200000000	V	CVE-2014-4720 on Ubuntu 19.04 (disco) - low.	2014-07-06
oval:com.ubuntu.cosmic:def:20144720000	V	CVE-2014-4720 on Ubuntu 18.10 (cosmic) - low.	2014-07-06
oval:com.ubuntu.cosmic:def:201447200000000	V	CVE-2014-4720 on Ubuntu 18.10 (cosmic) - low.	2014-07-06
oval:com.ubuntu.precise:def:20144720000	V	CVE-2014-4720 on Ubuntu 12.04 LTS (precise) - low.	2014-07-06

BACK