PT-2019-17672 · Pippo · Pippo

Amassey · Publicado 2019-06-12 · Atualizado 2020-10-16 · CVE-2019-5442

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Pippo version 1.12.0

Description The issue allows for a Denial of Service through an XML Entity Expansion, also known as a Billion Laughs Attack. This occurs when entities are created recursively, consuming large amounts of heap memory. As a result, the JVM process will eventually run out of memory. If the operating system does not limit the memory for this process, memory exhaustion will continue and can affect other processes on the system.

Recommendations For Pippo version 1.12.0, consider disabling XML entity expansion to prevent the Denial of Service attack until a patch is available. Restricting the amount of memory allocated to the JVM process can also help mitigate the issue.

Exploit

Correção

XML Entity Expansion

Enumeração de Fraquezas

CWE-776

Identificadores relacionados

CVE-2019-5442

GHSA-HWCX-9P4J-7HWJ

Produtos afetados

Pippo

Referências · 4

• 🔥 https://hackerone.com/reports/506791 · Exploit
• https://osv.dev/vulnerability/GHSA-hwcx-9p4j-7hwj · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5442 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5442 · Aviso do Fabricante