CVE-2019-5427

    Dashboard / Vulnerabilities / CVE-2019-5427

    CVE-2019-5427

    Published: 22 Apr 2019Last Modified: 7 Aug 2026

    Summary:

    Details: c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

    References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/, https://www.oracle.com/security-alerts/cpuapr2020.html, https://www.oracle.com/security-alerts/cpujan2021.html, https://www.oracle.com/security-alerts/cpujul2020.html, https://www.oracle.com/security-alerts/cpuoct2020.html, https://www.oracle.com/security-alerts/cpuoct2021.html, https://hackerone.com/reports/509315

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c61c00b1f7e3d6cf23501cd02b429474e4d22c73

    Affected versions

    c3p0-0.9.5.3
    c3p0-0.9.5.2
    c3p0-0.9.5.1
    c3p0-0.9.5
    c3p0-0.9.5-pre10
    c3p0-0.9.5-pre9
    c3p0-0.9.5-pre8
    c3p0-0.9.5-pre7
    c3p0-0.9.5-pre6
    c3p0-0.9.5-pre5
    c3p0-0.9.5-pre4
    c3p0-0.9.5-pre3
    c3p0-0.9.5-pre2
    c3p0-0.9.5-pre1
    c3p0-0.9.2
    c3p0-0.9.2-pre8
    c3p0-0.9.2-pre7
    c3p0-0.9.2-pre6
    c3p0-0.9.2-pre4
    c3p0-0.9.2-pre3
    c3p0-0.9.2-pre2-RELEASE

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2019-5427 | CVE-DB