CVE-2018-18898

HIGH EPSS 81.6%

Published Mar 21, 20197y ago · Modified Jun 17, 20262w ago

7.5 CVSS 3.1

High

Published Mar 21, 2019 7y ago

Last Modified Jun 17, 2026 2w ago

Description

The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

81.6% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-400 Uncontrolled Resource Consumption Resource Mgmt

Affected Products 7

Vendor	Product	Version	Range
bestpractical	request_tracker	*	≥4.1.13 – ≤4.4.0
fedoraproject	fedora	28	any
fedoraproject	fedora	29	any
canonical	ubuntu_linux	16.04	any
canonical	ubuntu_linux	18.04	any
debian	debian_linux	8.0	any
debian	debian_linux	10.0	any

References 5

bestpractical.com https://bestpractical.com/download-page

ProductRelease Notes
lists.debian.org https://lists.debian.org/debian-lts-announce/2020/02/msg00009.html

Mailing ListThird Party Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPJVDT77ZPRU5Z2BEMZM7EBY6WZHUATZ/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2/
usn.ubuntu.com https://usn.ubuntu.com/4517-1/

Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.