Debian/c3p0: high 7.5
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
Action: Upgrade c3p0 to 0.9.1.2-10.1~deb12u1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.9.1.2-10.1~deb12u1 | - |
Fixed versions
| 0.9.1.2-10.1~deb12u1 |
Sources
published · modified · JSON