Stay Secure with the Latest Linux Advisories

security advisoryupdateFedora

Fedora 31 FEDORA-2020-39d40d9ae9 Critical: Email MIME Parsing Limit Issue

This update limits the number of nested MIME parts to 10 (by default), to avoid a possible memory exhaustion issue with lots of tiny MIME parts.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-39d40d9ae9 2020-06-03 02:09:15.186924 --------------------------------------------------------------------------------Name : perl-Email-MIME-ContentType Product : Fedora 31 Version : 1.024 Release : 1.fc31 URL : https://metacpan.org/dist/Email-MIME-ContentType Summary : Parse a MIME Content-Type Header Description : This module is responsible for parsing email content type headers according to section 5.1 of RFC 2045. It returns a hash with entries for the type, the subtype, and a hash of attributes. For backward compatibility with a really unfortunate misunderstanding of RFC 2045 by the early implementors of this module, 'discrete' and 'composite' are also present in the returned hashref, with the values of 'type' and 'subtype' respectively. --------------------------------------------------------------------------------Update Information: This update limits the number of nested MIME parts to 10 (by default), to avoid a possible memory exhaustion issue with lots of tiny MIME parts. --------------------------------------------------------------------------------ChangeLog: * Sun May 24 2020 Paul Howarth - 1.024-1 - Update to 1.024 - Silence an uninitialized value warning - Avoid allowing non-Latin digits in numbers - Add new functions build_content_type() and build_content_disposition() * Wed Jan 29 2020 Fedora Release Engineering - 1.022-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Wed Oct 16 2019 Paul Howarth - 1.022-8 - Spec tidy-up - Use author-independent source URL - Classify buildreqs by usage - Use DESTDIR rather than PERL_INSTALL_ROOT - Simplify find command using -delete - Fix permissions verbosely - Use %license -Make %files list more explicit --------------------------------------------------------------------------------References: [ 1 ] Bug #1835353 - rubygem-mail: Out of memory issue through nested MIME parts https://bugzilla.redhat.com/show_bug.cgi?id=1835353 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-39d40d9ae9' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Revise boundary restrictions within nested MIME segments to prevent memory overflow problems in Fedora 31's perl-Email-MIME-ContentType library.. Fedora 31 Update, Email MIME Content, Memory Exhaustion Fix. . Severity: Critical. LinuxSecurity.com Team

Jun 02, 2020 •Critical Fedora