PT-2019-17672 · Pippo · Pippo

Amassey · Published 2019-06-12 · Updated 2020-10-16 · CVE-2019-5442

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Pippo version 1.12.0

Description The issue allows for a Denial of Service through an XML Entity Expansion, also known as a Billion Laughs Attack. This occurs when entities are created recursively, consuming large amounts of heap memory. As a result, the JVM process will eventually run out of memory. If the operating system does not limit the memory for this process, memory exhaustion will continue and can affect other processes on the system.

Recommendations For Pippo version 1.12.0, consider disabling XML entity expansion to prevent the Denial of Service attack until a patch is available. Restricting the amount of memory allocated to the JVM process can also help mitigate the issue.

Exploit

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2019-5442

GHSA-HWCX-9P4J-7HWJ

Affected Products

Pippo

References · 4

• 🔥 https://hackerone.com/reports/506791 · Exploit
• https://osv.dev/vulnerability/GHSA-hwcx-9p4j-7hwj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5442 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5442 · Vendor Advisory