~ / search / GHSA-84p2-vf58-xhxv

GHSA-84p2-vf58-xhxv

Billion laughs attack in c3p0

Source: GitHub Advisory Database (reviewed) High CVE-2019-5427

Packages

EcosystemPackageAffectedFixed in
Maven com.mchange:c3p0 < 0.9.5.4 0.9.5.4

Details

As written in the advisory (Markdown source, shown as plain text).

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

References

External links from the advisory. They lead to third-party sites.