Lucene search

K

HackeroneCVELIST:CVE-2019-5427

HistoryApr 22, 2019 - 8:52 p.m.

CVE-2019-5427

2019-04-2220:52:56

CWE-776

hackerone

www.cve.org

7

AI Score

7.3

Confidence

High

EPSS

0.023

Percentile

89.8%

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

CNA Affected

[
  {
    "product": "c3p0",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "before 0.9.5.4"
      }
    ]
  }
]

References

hackerone.com/reports/509315

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/

www.oracle.com/security-alerts/cpuapr2020.html

www.oracle.com/security-alerts/cpujan2021.html

www.oracle.com/security-alerts/cpujul2020.html

www.oracle.com/security-alerts/cpuoct2020.html

www.oracle.com/security-alerts/cpuoct2021.html

AI Score

7.3

Confidence

High

EPSS

0.023

Percentile

89.8%

Related for CVELIST:CVE-2019-5427

nessus5 ubuntu2 veracode2 osv5 debiancve1 prion1 cve1 github1 openvas5 redhatcve1 ubuntucve1 nvd1 fedora2 githubexploit1 hackerone1 mageia1 redhat1 ibm1 oracle5