CVE-2019-5442: XML Entity Expansion in Pippo
Summary
CVE-2019-5442: XML Entity Expansion in Pippo. Affects ro.pippo:pippo-jaxb versions < 1.12.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pippo is a Java micro web framework that focuses on simplicity and ease of use. It provides a lightweight and flexible platform for building web applications. The Pippo framework includes a module called pippo-jaxb, which is used for XML data binding and serialization. This module is vulnerable to XML Entity Expansion, also known as the Billion Laughs Attack.
Vulnerability Detail
The XML Entity Expansion vulnerability in Pippo 1.12.0 allows for a Denial of Service attack. By creating entities recursively, the attacker can consume large amounts of heap memory, eventually causing the JVM process to run out of memory. If the operating system does not limit the memory usage of the process, it can affect other processes on the system as well. This vulnerability has a CVSS score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a non-affected version of Pippo.
Conclusion
The XML Entity Expansion vulnerability in Pippo 1.12.0 can lead to a Denial of Service attack by consuming excessive memory. It is recommended to upgrade to a non-affected version of Pippo to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ro.pippo:pippo-jaxb →
FAQ
XML Entity Expansion is a technique where entities in an XML document are expanded recursively, leading to excessive memory consumption and potential Denial of Service attacks.
The impact of this vulnerability is a Denial of Service attack, where the JVM process running Pippo can run out of memory and crash. If memory usage is not limited by the operating system, it can also affect other processes on the system.
Pippo versions up to and including 1.12.0 are affected by this vulnerability.
Yes, this vulnerability has been fixed in versions of Pippo after 1.12.0. It is recommended to upgrade to a non-affected version.
There are no known workarounds for this vulnerability. It is recommended to apply the fix by upgrading to a non-affected version of Pippo.
