NetSight
IP …
high7.5

CVE-2019-5427

Billion laughs attack in c3p0

Impact

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.mchange:c3p0<= 0.9.5.30.9.5.4

Affected products

VendorProductAffected versions
MchangeC3p0
before 0.9.5.4
FedoraprojectFedora
Versions 29, 30
OracleCommunications Ip Service Activator
Versions 7.3.0, 7.4.0
OracleCommunications Session Route Manager
from 8.2.0 through 8.2.2
OracleDocumaker
from 12.6.0 through 12.6.6
OracleEnterprise Manager Base Platform
Version 13.2.1.0
OracleEnterprise Manager Ops Center
Version 12.4.0.0
OracleFlexcube Private Banking
Versions 12.0.0, 12.1.0
OracleHyperion Infrastructure Technology
Version 11.1.2.4
OracleRetail Xstore Point Of Service
Versions 15.0, 16.0, 17.0, 18.0, 19.0
OracleWebcenter Sites
Versions 12.2.1.3.0, 12.2.1.4.0

Weakness classification

CWE-776

References