Lucene search
GoogleOSV:GHSA-Q485-J897-QC27HistoryJan 07, 2019 - 7:14 p.m.
XML External Entity Reference in mchange:c3p0
2019-01-0719:14:34
Google
osv.dev
39
EPSS
0.006
Percentile
78.4%
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
References
github.com/advisories/GHSA-q485-j897-qc27
github.com/zhutougg/c3p0
github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87b
lists.debian.org/debian-lts-announce/2018/12/msg00021.html
lists.fedoraproject.org/archives/list/[email protected]/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR
lists.fedoraproject.org/archives/list/[email protected]/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4
nvd.nist.gov/vuln/detail/CVE-2018-20433
Related
ubuntucve
ubuntucve
CVE-2018-20433
2018-12-24 00:00:00
osv
osv
CVE-2018-20433
2018-12-24 13:29:00
c3p0-0.9.5.5-1.3 on GA media
2024-06-15 00:00:00
c3p0 - security update
2018-12-28 00:00:00
cve
cve
CVE-2018-20433
2018-12-24 13:29:00
github
github
XML External Entity Reference in mchange:c3p0
2019-01-07 19:14:34
redhatcve
redhatcve
CVE-2018-20433
2019-01-09 14:20:42
nessus
nessus
Debian DLA-1621-1 : c3p0 security update
2018-12-31 00:00:00
Fedora 29 : c3p0 (2019-063672154a)
2019-05-29 00:00:00
Fedora 30 : c3p0 (2019-cb14e234fc)
2019-05-29 00:00:00
debian
debian
[SECURITY] [DLA 1621-1] c3p0 security update
2018-12-28 18:58:36
cvelist
cvelist
CVE-2018-20433
2018-12-24 13:00:00
debiancve
debiancve
CVE-2018-20433
2018-12-24 13:29:00
nvd
nvd
CVE-2018-20433
2018-12-24 13:29:00
prion
prion
Design/Logic Flaw
2018-12-24 13:29:00
openvas
openvas
Debian: Security Advisory (DLA-1621-1)
2019-01-02 00:00:00
Mageia: Security Advisory (MGASA-2020-0051)
2022-01-28 00:00:00
Fedora Update for c3p0 FEDORA-2019-063672154a
2019-06-02 00:00:00
fedora
fedora
[SECURITY] Fedora 30 Update: c3p0-0.9.5.4-1.fc30
2019-05-29 00:50:47
[SECURITY] Fedora 29 Update: c3p0-0.9.5.4-1.fc29
2019-05-29 02:59:54
veracode
veracode
XML External Entity (XXE)
2018-12-26 01:56:50
githubexploit
githubexploit
hackerone
hackerone
mageia
mageia
Updated c3p0 packages fix security vulnerabilities
2020-01-28 10:52:40
ibm
ibm
Security Bulletin: Multiple Vulnerabilities identified in IBM StoredIQ
2020-02-20 12:42:12