https://bugzilla.redhat.com/show_bug.cgi?id=1709860
Bug ID: 1709860 Summary: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190417,reported=20190424,sour ce=cve,cvss3=7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/ I:N/A:H,cwe=CWE-776,fedora-all/c3p0=affected,epel-7/c3 p0=affected,rhes-3/c3p0=new,rhpam-7/c3p0=new,fuse-6/c3 p0=new,fuse-7/c3p0=new,rhn_satellite_6/c3p0=new,jbews- 2/c3p0=new,rhn_satellite_5/c3p0=new,rhmap-4/c3p0=new,v ertx-3/c3p0=new,soap-5/c3p0=new,bpms-6/c3p0=new Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: msiddiqu@redhat.com CC: aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, avibelli@redhat.com, bbuckingham@redhat.com, bcourt@redhat.com, bgeorges@redhat.com, bkearney@redhat.com, btotty@redhat.com, cbyrne@redhat.com, chazlett@redhat.com, cmacedo@redhat.com, csutherl@redhat.com, decathorpe@gmail.com, dffrench@redhat.com, dingyichen@gmail.com, drusso@redhat.com, etirelli@redhat.com, ggainey@redhat.com, gvarsami@redhat.com, gzaronik@redhat.com, hhudgeon@redhat.com, ibek@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jbalunas@redhat.com, jclere@redhat.com, jcoleman@redhat.com, jmadigan@redhat.com, jochrist@redhat.com, jpallich@redhat.com, jshepherd@redhat.com, kconner@redhat.com, krathod@redhat.com, kverlaen@redhat.com, ldimaggi@redhat.com, lef@fedoraproject.org, lgao@redhat.com, lpetrovi@redhat.com, lthon@redhat.com, mat.booth@redhat.com, mbabacek@redhat.com, mmccune@redhat.com, mnovotny@redhat.com, mszynkie@redhat.com, myarboro@redhat.com, ngough@redhat.com, nwallace@redhat.com, paradhya@redhat.com, pgallagh@redhat.com, ppenicka@redhat.com, pwright@redhat.com, rchan@redhat.com, rjerrido@redhat.com, rrajasek@redhat.com, rruss@redhat.com, rsynek@redhat.com, rwagner@redhat.com, sdaley@redhat.com, sisharma@redhat.com, smohan@redhat.com, ssaha@redhat.com, stewardship-sig@lists.fedoraproject.org, tcunning@redhat.com, tkirby@redhat.com, tlestach@redhat.com, trepel@redhat.com, trogers@redhat.com, twalsh@redhat.com, vbellur@redhat.com, weli@redhat.com Target Milestone: --- Classification: Other
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
References:
https://hackerone.com/reports/509315 http://www.cvedetails.com/cve/CVE-2019-5427/
Upstream commit:
https://github.com/swaldman/c3p0/commit/f38f27635c384806c2a9d6500d80183d9f09...
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
msiddiqu@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1709861, 1709862
--- Comment #1 from msiddiqu@redhat.com --- Created c3p0 tracking bugs for this issue:
Affects: epel-7 [bug 1709862] Affects: fedora-all [bug 1709861]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1709861 [Bug 1709861] CVE-2019-5427 c3p0: loading XML configuration leads to denial of service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1709862 [Bug 1709862] CVE-2019-5427 c3p0: loading XML configuration leads to denial of service [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
msiddiqu@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1709863
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
--- Comment #2 from Joshua Padman jpadman@redhat.com --- This vulnerability is out of security support scope for the following products: * Red Hat JBoss Fuse 6 * Red Hat JBoss SOA Platform 5 * Red Hat JBoss BPM Suite 6
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
Cedric Buissart 🐶 cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2019 |impact=moderate,public=2019 |0417,reported=20190424,sour |0417,reported=20190424,sour |ce=cve,cvss3=7.5/CVSS:3.0/A |ce=cve,cvss3=7.5/CVSS:3.0/A |V:N/AC:L/PR:N/UI:N/S:U/C:N/ |V:N/AC:L/PR:N/UI:N/S:U/C:N/ |I:N/A:H,cwe=CWE-776,fedora- |I:N/A:H,cwe=CWE-776,fedora- |all/c3p0=affected,epel-7/c3 |all/c3p0=affected,epel-7/c3 |p0=affected,rhes-3/c3p0=new |p0=affected,rhes-3/c3p0=new |,rhpam-7/c3p0=new,fuse-6/c3 |,rhpam-7/c3p0=new,fuse-6/c3 |p0=new,fuse-7/c3p0=new,rhn_ |p0=new,fuse-7/c3p0=new,rhn_ |satellite_6/c3p0=new,jbews- |satellite_6/c3p0=new,jbews- |2/c3p0=new,rhn_satellite_5/ |2/c3p0=new,rhn_satellite_5/ |c3p0=new,rhmap-4/c3p0=new,v |c3p0=new/impact=low,rhmap-4 |ertx-3/c3p0=new,soap-5/c3p0 |/c3p0=new,vertx-3/c3p0=new, |=new,bpms-6/c3p0=new |soap-5/c3p0=new,bpms-6/c3p0 | |=new
--- Comment #3 from Cedric Buissart 🐶 cbuissar@redhat.com --- In Satellite 5 context : setting severity to Low, because the attack requires c3p0 to be provided with a specially crafted XML configuration file. This should not happen unless the Satellite is already severely compromised.
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
Siddharth Sharma sisharma@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2019 |impact=moderate,public=2019 |0417,reported=20190424,sour |0417,reported=20190424,sour |ce=cve,cvss3=7.5/CVSS:3.0/A |ce=cve,cvss3=7.5/CVSS:3.0/A |V:N/AC:L/PR:N/UI:N/S:U/C:N/ |V:N/AC:L/PR:N/UI:N/S:U/C:N/ |I:N/A:H,cwe=CWE-776,fedora- |I:N/A:H,cwe=CWE-776,fedora- |all/c3p0=affected,epel-7/c3 |all/c3p0=affected,epel-7/c3 |p0=affected,rhes-3/c3p0=new |p0=affected,rhes-3/c3p0=won |,rhpam-7/c3p0=new,fuse-6/c3 |tfix,rhpam-7/c3p0=new,fuse- |p0=new,fuse-7/c3p0=new,rhn_ |6/c3p0=new,fuse-7/c3p0=new, |satellite_6/c3p0=new,jbews- |rhn_satellite_6/c3p0=new,jb |2/c3p0=new,rhn_satellite_5/ |ews-2/c3p0=new,rhn_satellit |c3p0=new/impact=low,rhmap-4 |e_5/c3p0=new/impact=low,rhm |/c3p0=new,vertx-3/c3p0=new, |ap-4/c3p0=new,vertx-3/c3p0= |soap-5/c3p0=new,bpms-6/c3p0 |new,soap-5/c3p0=new,bpms-6/ |=new |c3p0=new
https://bugzilla.redhat.com/show_bug.cgi?id=1709860 Bug 1709860 depends on bug 1709861, which changed state.
Bug 1709861 Summary: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1709861
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |low CC| |lzap@redhat.com, | |mhulan@redhat.com, | |tbrisker@redhat.com Whiteboard|impact=moderate,public=2019 |impact=low,public=20190417, |0417,reported=20190424,sour |reported=20190424,source=cv |ce=cve,cvss3=7.5/CVSS:3.0/A |e,cvss3=4.4/CVSS:3.0/AV:L/A |V:N/AC:L/PR:N/UI:N/S:U/C:N/ |C:L/PR:H/UI:N/S:U/C:N/I:N/A |I:N/A:H,cwe=CWE-776,fedora- |:H,cwe=CWE-776,fedora-all/c |all/c3p0=affected,epel-7/c3 |3p0=affected,epel-7/c3p0=af |p0=affected,rhes-3/c3p0=won |fected,rhes-3/c3p0=wontfix, |tfix,rhpam-7/c3p0=new,fuse- |rhpam-7/c3p0=new,fuse-6/c3p |6/c3p0=new,fuse-7/c3p0=new, |0=new,fuse-7/c3p0=new,rhn_s |rhn_satellite_6/c3p0=new,jb |atellite_6/candlepin=notaff |ews-2/c3p0=new,rhn_satellit |ected,jbews-2/c3p0=new,rhn_ |e_5/c3p0=new/impact=low,rhm |satellite_5/c3p0=new/impact |ap-4/c3p0=new,vertx-3/c3p0= |=low,rhmap-4/c3p0=new,vertx |new,soap-5/c3p0=new,bpms-6/ |-3/c3p0=new,soap-5/c3p0=new |c3p0=new |,bpms-6/c3p0=new Severity|medium |low
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
--- Comment #4 from Doran Moppert dmoppert@redhat.com --- Statement:
Red Hat Satellite 6 is not vulnerable to this issue, because the candlepin component who uses the c3p0 jar never passes a XML configuration file to c3p0, even though it includes a vulnerable version of the latter. Since this issue requires a XML files to be loaded by c3p0, an exploitation path doesn't exist.
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
--- Comment #5 from Jason Shepherd jshepherd@redhat.com --- This vulnerability is out of security support scope for the following product:
* Red Hat Mobile Application Platform
Please refer to https://access.redhat.com/support/policy/updates/rhmap for more details
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
--- Comment #6 from Joshua Padman jpadman@redhat.com --- This vulnerability is out of security support scope for the following product: * Red Hat JBoss Enterprise Web Server 2
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |c3p0 0.9.5.4
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
--- Comment #10 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.6.0
Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:0983
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2020-03-26 16:32:11
--- Comment #11 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-5427
https://bugzilla.redhat.com/show_bug.cgi?id=1709860 Bug 1709860 depends on bug 1709862, which changed state.
Bug 1709862 Summary: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1709862
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
java-sig-commits@lists.fedoraproject.org