CVE-2019-5427 – c3p0: loading XML configuration leads to denial of service

https://notcve.org/view.php?id=CVE-2019-5427

22 Apr 2019 — c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration. En c3p0 versiones <0.9.5.4, puede ser explotada por un ataque de tipo a billion laughs al cargar la configuración XML producto de la falta de protecciones faltantes contra la expansión recursiva de la entidad al cargar la configuración. This release of Red Hat Fuse 7.6.0 serves as a replacement for Red Hat Fuse 7.5, and in... • https://github.com/shanika04/cp30_XXE_partial_fix • CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') •