CVE-2019-5442 XML Entity Expansion in Pippo
An attacker can cause a Denial of Service in Pippo by triggering recursive XML entity expansion, exhausting JVM memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5442?
CVE-2019-5442 is a high-severity denial of service vulnerability in Pippo, published on 12 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.
Weakness: CWE-776
Which versions are affected by CVE-2019-5442?
2 open source packages ship an affected version, including ro.pippo:pippo-jaxb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ro.pippo:pippo-jaxb Maven | All versions to 1.12.0 | None |
ro.pippo:pippo-jaxb Maven | All versions to 1.12.0 | None |
Products include Pippo Pippo.
How do I fix CVE-2019-5442?
No fix has been published for CVE-2019-5442 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-5442 being exploited?
There is no known exploitation of CVE-2019-5442 in the wild and no public exploit code.
Other vulnerabilities in Pippo
Sources
Also known as GHSA-hwcx-9p4j-7hwj.