Description

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

Remediation

References

https://hackerone.com/reports/509315

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/

https://www.oracle.com/security-alerts/cpuapr2020.html

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/security-alerts/cpuoct2020.html

https://www.oracle.com/security-alerts/cpuoct2021.html

Related Vulnerabilities

CVE-2021-37701 Vulnerability in npm package tar

CVE-2023-3696 Vulnerability in maven package org.webjars.npm:mongoose

CVE-2017-3200 Vulnerability in maven package org.graniteds:granite-generator

CVE-2022-26260 Vulnerability in npm package simple-plist

CVE-2021-23360 Vulnerability in npm package killport

Severity

High

Classification

CWE-776 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Exploit Issue Tracking Patch Third Party Advisory