Description

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

Remediation

References

https://hackerone.com/reports/509315

https://www.oracle.com/security-alerts/cpuapr2020.html

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/security-alerts/cpuoct2020.html

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com/security-alerts/cpuoct2021.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/

Related Vulnerabilities

CVE-2022-25296 Vulnerability in npm package bodymen

CVE-2022-0841 Vulnerability in npm package npm-lockfile

CVE-2023-35146 Vulnerability in maven package org.jenkins.plugin.templateworkflows:template-workflows

CVE-2020-7688 Vulnerability in npm package mversion

CVE-2022-43407 Vulnerability in maven package org.jenkins-ci.plugins:pipeline-input-step

Severity

High

Classification

CWE-776 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Exploit Issue Tracking Patch Third Party Advisory