PT-2018-15374 · Mchange+1 · C3P0+1

Zhutougg · Published 2018-12-24 · Updated 2024-06-15 · CVE-2018-20433

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions c3p0 version 0.9.5.2

Description The issue allows XXE (XML External Entity) attacks in the extractXmlConfigFromInputStream function within com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during the initialization process.

Recommendations For c3p0 version 0.9.5.2, consider disabling the extractXmlConfigFromInputStream function as a temporary workaround until a patch is available. Restrict access to the C3P0ConfigXmlUtils class to minimize the risk of exploitation. Avoid using external XML entities in the configuration until the issue is resolved.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-20433

DLA-1621-1

GHSA-Q485-J897-QC27

MGASA-2020-0051

OPENSUSE-SU-2024:10669-1

SUSE-SU-2022:0798-1

SUSE-SU-2022:1397-1

Affected Products

Suse

C3P0

References · 71

• https://osv.dev/vulnerability/DEBIAN-CVE-2018-20433 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1397-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0051.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0051 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0798-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20433 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q485-j897-qc27 · Vendor Advisory
• https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87b · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-20433 · Security Note
• https://security-tracker.debian.org/tracker/source-package/c3p0 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1621-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20433 · Security Note