Bug 23208

Assigning to the Perl stack maintainers, CC'ing the registered maintainer.

Assignee: bugsquad => perl
CC: (none) => marja11, shlomif

See CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12558 and https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901873

CC: (none) => bruno

On CPAN the module is marked as deprecated. The problem is that it's used by bugzilla (and a bunch of other perl modules)

The page says:
"ACHTUNG! This module has a vulnerability (CVE-2015-7686) which allows remote attackers to cause denial of service. In other words, sometimes it takes way too long to process certain kinds of input. Maybe someday this will be fixed. Until then, use Email::Address::XS instead which has backward compatible API."

Should we try to fix this or use the other module or ... ?

Interesting.  Would we have to patch the "use" lines in everything that requires it to add the ::XS on the end?  I guess then perl-Email-Address-XS would obsolete it (it'd have to be packaged first).

(In reply to David Walser from comment #4)
> Interesting.  Would we have to patch the "use" lines in everything that
> requires it to add the ::XS on the end?  

Indeed probably.

> I guess then perl-Email-Address-XS
> would obsolete it (it'd have to be packaged first).

Or we can add that in the spec file.
We could try to make that change on a perl module having a test suite and see whether this is a way forward or not.

I wonder how the bugzilla project is managing that ...

Fedora has issued an advisory for this on January 18:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KBO66KNCLV5H73UNWXAZ6VHSLBB6ZIAW/

The issue is fixed upstream in 1.912 (already in Cauldron).

Source RPM: perl-Email-Address-1.909.0-1.mga7.src.rpm => perl-Email-Address-1.908.0-3.mga6.src.rpm
Version: Cauldron => 6
Whiteboard: MGA6TOO => (none)

perl-Email-Address-1.912.0-1.mga6 uploaded by Shlomi.  Advisory to come later.

Assignee: perl => qa-bugs

Advisory:
========================

Updated perl-Email-Address package fixes security vulnerability:

The parse() method in the Email::Address module through 1.912 for Perl can
consume a large amount of resources on specially prepared input, leading to
Denial of Service. Prepared special input that caused this problem contained 30
form-field characters ("\f") (CVE-2018-12558).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12558
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KBO66KNCLV5H73UNWXAZ6VHSLBB6ZIAW/
========================

Updated packages in core/updates_testing:
========================
perl-Email-Address-1.912.0-1.mga6

from perl-Email-Address-1.912.0-1.mga6.src.rpm

Testing M6/64
The standard quickie test (again thanks to Claire) is at the end of:
 https://bugs.mageia.org/show_bug.cgi?id=13541#c5 reproduced below.
(The previous 'grep' is *not* a test, just a check on a source change).
-----------------
$ cat testcase.pl 
use Email::Address;
  my @addresses = Email::Address->parse($line);
  my $address   = Email::Address->new(Casey => 'casey@localhost');
  print $address->format . "\n";

$ perl testcase.pl
"Casey" <casey@localhost>
-------------------------
The CVE points to a useful quick test for this fault:
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901873
"Root of this problem is that parsing of email addresses in Email::Address module is done by regular expressions, which in perl can be exponential. The trivial input is 30 form-fields characters. You can test it with following oneliner:"
 $ perl -MEmail::Address -E 'Email::Address->parse("\f" x 30)'

BEFORE update: perl-Email-Address-1.908.0-3.mga6
The special given test hogged a processor for a very long time, I eventually killed it.

AFTER update: perl-Email-Address-1.912.0-1.mga6
The given one-liner above now terminated instantly. GOOD.
And the standard quickie worked. The update is good, validating it.

Whiteboard: (none) => MGA6-64-OK
Keywords: (none) => advisory, validated_update
CC: (none) => lewyssmith, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0046.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED