CVE-2019-5427
Fixed in a distro release EPSS 5%
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
Products: mchange c3p0, fedoraproject fedora, oracle communications_ip_service_activator, oracle communications_session_route_manager, oracle documaker, oracle enterprise_manager_base_platform, oracle enterprise_manager_ops_center, oracle flexcube_private_banking, oracle hyperion_infrastructure_technology, oracle retail_xstore_point_of_service, oracle webcenter_sites
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | com.mchange:c3p0 | 0.9.5.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | c3p0 | 0.9.1.2-10.1~deb12u1 |
| Debian 13 | c3p0 | 0.9.1.2-10.1 |
| Debian 14 | c3p0 | 0.9.1.2-10.1 |
| SUSE Manager Server Module 4.1 | c3p0 | 0.9.5.5-3.3.2 |
| SUSE Manager Server Module 4.1 | dhcpd-formula | 0.1.1641480250.d5bd14c-3.3.2 |
| SUSE Manager Server Module 4.1 | hub-xmlrpc-api | 0.7-3.9.2 |
| SUSE Manager Server Module 4.1 | py26-compat-msgpack-python | 0.4.6-3.6.2 |
| SUSE Manager Server Module 4.1 | py27-compat-salt | 3000.3-6.21.2 |
| SUSE Manager Server Module 4.1 | spacecmd | 4.1.17-4.36.2 |
| SUSE Manager Server Module 4.1 | spacewalk-java | 4.1.44-3.66.2 |
| SUSE Manager Server Module 4.1 | spacewalk-web | 4.1.32-3.42.2 |
| SUSE Manager Server Module 4.1 | susemanager | 4.1.33-3.45.2 |
| SUSE Manager Server Module 4.1 | susemanager-doc-indexes | 4.1-11.52.2 |
| SUSE Manager Server Module 4.1 | susemanager-docs_en | 4.1-11.52.2 |
| SUSE Manager Server Module 4.1 | susemanager-schema | 4.1.25-3.42.2 |
| SUSE Manager Server Module 4.1 | susemanager-sls | 4.1.34-3.59.2 |
| SUSE Manager Server Module 4.2 | c3p0 | 0.9.5.5-150300.4.6.1 |
| SUSE Manager Server Module 4.2 | grafana-formula | 0.7.0-150300.3.6.1 |
| SUSE Manager Server Module 4.2 | hub-xmlrpc-api | 0.7-150300.3.6.1 |
| SUSE Manager Server Module 4.2 | inter-server-sync | 0.1.0-150300.8.12.1 |
| SUSE Manager Server Module 4.2 | mgr-osad | 4.2.8-150300.2.9.1 |
| SUSE Manager Server Module 4.2 | mgr-push | 4.2.5-150300.2.9.1 |
| SUSE Manager Server Module 4.2 | patterns-suse-manager | 4.2-150300.4.9.1 |
| SUSE Manager Server Module 4.2 | prometheus-exporters-formula | 1.2.0-150300.3.9.1 |
| SUSE Manager Server Module 4.2 | py26-compat-msgpack-python | 0.4.6-150300.4.3.1 |
| SUSE Manager Server Module 4.2 | rhnlib | 4.2.6-150300.4.9.1 |
| SUSE Manager Server Module 4.2 | saltboot-formula | 0.1.1645440615.7f1328c-150300.3.9.1 |
| SUSE Manager Server Module 4.2 | smdba | 1.7.10-0.150300.3.3.1 |
| SUSE Manager Server Module 4.2 | spacecmd | 4.2.16-150300.4.18.1 |
| SUSE Manager Server Module 4.2 | spacewalk-admin | 4.2.10-150300.3.9.1 |
| SUSE Manager Server Module 4.2 | spacewalk-backend | 4.2.20-150300.4.18.1 |
| SUSE Manager Server Module 4.2 | spacewalk-branding | 4.2.13-150300.3.9.1 |
| SUSE Manager Server Module 4.2 | spacewalk-certs-tools | 4.2.15-150300.3.15.1 |
| SUSE Manager Server Module 4.2 | spacewalk-client-tools | 4.2.18-150300.4.18.1 |
| SUSE Manager Server Module 4.2 | spacewalk-config | 4.2.6-150300.3.6.1 |
| SUSE Manager Server Module 4.2 | spacewalk-java | 4.2.34-150300.3.26.2 |
| SUSE Manager Server Module 4.2 | spacewalk-web | 4.2.26-150300.3.18.2 |
| SUSE Manager Server Module 4.2 | subscription-matcher | 0.29-150300.6.6.1 |
| SUSE Manager Server Module 4.2 | supportutils-plugin-susemanager | 4.2.4-150300.3.6.1 |
| SUSE Manager Server Module 4.2 | suseRegisterInfo | 4.2.6-150300.4.9.1 |
| SUSE Manager Server Module 4.2 | susemanager | 4.2.28-150300.3.22.1 |
| SUSE Manager Server Module 4.2 | susemanager-doc-indexes | 4.2-150300.12.22.1 |
| SUSE Manager Server Module 4.2 | susemanager-docs_en | 4.2-150300.12.22.1 |
| SUSE Manager Server Module 4.2 | susemanager-schema | 4.2.21-150300.3.18.1 |
| SUSE Manager Server Module 4.2 | susemanager-sls | 4.2.21-150300.3.20.1 |
| SUSE Manager Server Module 4.2 | virtualization-formulas | 0.6.2-150300.8.6.1 |
| Ubuntu 18.04 LTS | c3p0 | 0.9.1.2-9+deb8u1ubuntu0.18.04.1 |
| Ubuntu 20.04 LTS | c3p0 | 0.9.1.2-10ubuntu0.20.04.1 |
| Ubuntu 22.04 LTS | c3p0 | 0.9.1.2-10ubuntu1 |
| Ubuntu 24.04 LTS | c3p0 | 0.9.1.2-10ubuntu1 |
| Ubuntu Pro 14.04 LTS | c3p0 | 0.9.1.2-9+deb8u1ubuntu0.14.04.1~esm1 |
| Ubuntu Pro 16.04 LTS | c3p0 | 0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm1 |
| openSUSE Tumbleweed | c3p0 | 0.9.5.5-2.1 |