CVE-2019-5427 PUBLISHED

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

EPSS 3.91% · 88.2th percentile

Risk Scores

EPSS Score
3.91%
88.2th percentile

Affected Products

VendorProductVersions
Ubuntu:24.04:LTSc3p00
Ubuntu:22.04:LTSc3p00.9.1.2-10, 0
Ubuntu:Pro:16.04:LTSc3p00.9.1.2-9+deb8u1build0.16.04.1, 0, 0.9.1.2-9
Ubuntu:Pro:14.04:LTSc3p00, 0.9.1.2-7, 0.9.1.2-9
Ubuntu:20.04:LTSc3p00, 0.9.1.2-10
Ubuntu:18.04:LTSc3p00.9.1.2-9+deb8u1build0.18.04.1, 0.9.1.2-9, 0

Timeline

References

Open in Interactive Console →