GitHub Advisoryadvisory · Maven

GHSA-hwcx-9p4j-7hwj XML Entity Expansion in Pippo

HIGH Published 2019-06-13 Modified 2021-08-16 Official page ↗
Aliases
CVE-2019-5442
Ecosystem
Maven
Packages
ro.pippo:pippo-jaxb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-776
Reviewed
2019-06-13

Affected packages

• Maven ro.pippo:pippo-jaxb: <= 1.12.0 (no fix yet)

Description

XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.

Related

Alias · CVE (1)

  • CVE-2019-5442 XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large… vulnerability

Weakness · CWE (1)

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References