Remote Code Execution

Pippo is vulnerable to remote code execution attacks. A remote, unauthenticated attacker could create a malicious object, base64 encode it, and place it in the PIPPOSESSION field of a cookie to exploit the flawed Cookie Handler component causing denial of service conditions. Affected by this issu...

GHSA-HWCX-9P4J-7HWJ XML Entity Expansion in Pippo

XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...

XML Entity Expansion in Pippo

XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...

Denial Of Service (DoS)

Pippo Content Type Parent is vulnerable to denial of service. Pippo unsafely parses user provided XML as it allows user to provide DTD. The attacker thus could craft a malicious input to trigger a billion laughs attack, crashing the system...

Input validation

XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...

CVE-2019-5442

XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...

CVE-2019-5442

XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...

CVE-2019-5442

XML Entity Expansion Billion Laughs Attack on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will...

CVE-2019-5442

CVE-2019-5442 describes an XML Entity Expansion (Billion Laughs) vulnerability in Pippo 1.12.0 where untrusted XML parsing can trigger recursive entities via a DTD, causing DoS through excessive heap memory consumption and potential JVM memory exhaustion. Connected records confirm Pippo 1.12.0 as...

Central Security Project: Pippo XML Entity Expansion (Billion Laughs Attack)

Maven artifact groupId: ro.pippo artifactId: pippo-jaxb version: 1.12.0 Vulnerability Vulnerability Description Pippo unsafely parses user provided XML. The fromString in the ro.pippo.jaxb.JaxbEngine class allows user provided DTDs that the rest of the XML may reference. This can lead to recursiv...

Improper Restriction of XML External Entity Reference in pippo-core

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE...

GHSA-RMM5-G63H-M6G9 Improper Restriction of XML External Entity Reference in pippo-core

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE...

XML External Entity (XXE)

Pippo JAXB is vulnerable to XML external entity XXE. The XML parser does not disable the usage of external Document Type Definition DTD, allowing a remote attacker to perform XXE attacks via a crafted XML file...

CVE-2018-20059

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE...

CVE-2018-20059

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE...

CVE-2018-20059

CVE-2018-20059 concerns Pippo 1.11.0 where jaxb/JaxbEngine.java allows XML External Entity (XXE) processing. The issue arises from the XML parser not disabling external DTD usage, enabling potential XXE attacks. Connected advisories (GHSA-RMM5-G63H-M6G9, VERACODE, Red Hat/OSV entries) corroborate...

CVE-2018-20059

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE...

GHSA-7FM6-2QW4-G3X3 Deserialization of Untrusted Data in Pippo

An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode calls ObjectInputStream.readObject to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPOSESSION...

Deserialization of Untrusted Data in Pippo

An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode calls ObjectInputStream.readObject to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPOSESSION...

GHSA-XJRR-XV9M-4PW5 Improper Input Validation in alilibaba:fastjson

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...