CVE-2018-18898
HIGHBest Practical Request Tracker 4.1.13-4.4 - Denial of Service via Email Address Parsing
Title source: llmDescription
The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.
References (5)
Core 5
Core References
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPJVDT77ZPRU5Z2BEMZM7EBY6WZHUATZ/
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2/
Product, Release Notes x_refsource_confirm
https://bestpractical.com/download-page
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/02/msg00009.html
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/4517-1/
Scores
CVSS v3
7.5
EPSS
0.0156
EPSS Percentile
81.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-400
Status
published
Products (7)
bestpractical/request_tracker
4.1.13 - 4.4.0
canonical/ubuntu_linux
16.04
canonical/ubuntu_linux
18.04
debian/debian_linux
8.0
debian/debian_linux
10.0
fedoraproject/fedora
28
fedoraproject/fedora
29
Published
Mar 21, 2019
Tracked Since
Feb 18, 2026