https://bugzilla.redhat.com/show_bug.cgi?id=1593318
--- Comment #6 from Petr Pisar <ppisar(a)redhat.com> ---
Email-Address-1.910 (1.911 and 1.912 updates a documentation) fixes this
vulnerability by extensive use of independent subexpressions ("(?>pattern)"
constructs) that prevents from undesired backtracking. An excerpt from the fix:
-my $cfws = qr/$comment|\s+/;
+my $cfws = qr/$comment|(?>\s+)/;
The exponential backtracking is the cause of this vulnerability and is indeed
fixed:
[test@fedora-30 Email-Address-1.912]$ time perl -Ilib -e 'use Email::Address;
Email::Address->parse("\f" x 30)'
real 0m0.017s
user 0m0.010s
sys 0m0.007s
--
You are receiving this mail because:
You are on the CC list for the bug.