{"id":"CVE-2018-20433","aliases":["CLSA-2026-1793965939","CLSA-2026-1793966046","DEBIAN-CVE-2018-20433","DLA-1621-1","EUVD-2019-0193","GHSA-q485-j897-qc27","MGASA-2020-0051","SUSE-SU-2022:0798-1","SUSE-SU-2022:1397-1","UBUNTU-CVE-2018-20433","openSUSE-SU-2024:10669-1"],"status":"published","title":"XML External Entity Reference in mchange:c3p0","description":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04589,"percentile":0.91705,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-611"],"published":"2018-12-24T13:00:00Z","modified":"2026-11-06T19:00:05Z","exploits":[{"source":"pocgithub","id":"shanika04/cp30_XXE_partial_fix","title":"shanika04/cp30_XXE_partial_fix","date":"2020-12-13","url":"https://github.com/shanika04/cp30_XXE_partial_fix"}],"fixes":[{"ecosystem":"Maven","package":"com.mchange:c3p0","fixed_in":["0.9.5.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"c3p0","fixed_in":["0.9.1.2-10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"c3p0","fixed_in":["0.9.1.2-10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"c3p0","fixed_in":["0.9.1.2-10"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"c3p0","fixed_in":["0.9.1.2-9+deb8u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-9+deb8u1build0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-9+deb8u1build0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"c3p0","fixed_in":["0.9.1.2-9+deb8u1build0.18.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"c3p0","fixed_in":["0.9.5.5-1.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.5.2"},{"fixed":"0.9.5.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.5.2"},{"fixed":"0.9.5.2-tuxcare.2"}]}],"versions":["0.9.5.2","0.9.5.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.2.1"},{"fixed":"0.9.2.1-tuxcare.3"}]}],"versions":["0.9.2.1","0.9.2.1-tuxcare.1","0.9.2.1-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-10"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-9+deb8u1"}]}],"versions":["0.9.1.2-9"]},{"source":"osv","ecosystem":"Maven","package":"com.mchange:c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.3"}]}],"versions":["0.9.2","0.9.2-pre2-RELEASE","0.9.2-pre3","0.9.2-pre4","0.9.2-pre5","0.9.2-pre6","0.9.2-pre7","0.9.2-pre8","0.9.2.1","0.9.5","0.9.5-pre1","0.9.5-pre10","0.9.5-pre2","0.9.5-pre3","0.9.5-pre4","0.9.5-pre5","0.9.5-pre6","0.9.5-pre7","0.9.5-pre8","0.9.5-pre9","0.9.5.1","0.9.5.2"]},{"source":"osv","ecosystem":"Mageia:7","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.4-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.5-3.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"dhcpd-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1641480250.d5bd14c-3.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"hub-xmlrpc-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-3.9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py26-compat-msgpack-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6-3.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-6.21.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.17-4.36.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.44-3.66.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.32-3.42.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.33-3.45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.52.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.52.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.25-3.42.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.34-3.59.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.5-150300.4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-150300.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"hub-xmlrpc-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-150300.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-150300.8.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8-150300.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5-150300.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-150300.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"py26-compat-msgpack-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6-150300.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6-150300.4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1645440615.7f1328c-150300.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.10-0.150300.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-150300.4.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.10-150300.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.20-150300.4.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.13-150300.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-150300.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.18-150300.4.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6-150300.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.34-150300.3.26.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.26-150300.3.18.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29-150300.6.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"supportutils-plugin-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-150300.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"suseRegisterInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6-150300.4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.28-150300.3.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-150300.12.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.21-150300.3.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.21-150300.3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"virtualization-formulas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2-150300.8.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-9+deb8u1build0.14.04.1"}]}],"versions":["0.9.1.2-7","0.9.1.2-9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-9+deb8u1build0.16.04.1"}]}],"versions":["0.9.1.2-9"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1.2-9+deb8u1build0.18.04.1"}]}],"versions":["0.9.1.2-9"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"c3p0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5.5-1.3"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"mchange","product":"c3p0"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2018/12/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20433","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q485-j897-qc27","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-20433","tags":["advisory"]},{"url":"https://github.com/zhutougg/c3p0","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2020-0051.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25906","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220798-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1097531","tags":["report"]},{"url":"https://bugzilla.suse.com/1133198","tags":["report"]},{"url":"https://bugzilla.suse.com/1190781","tags":["report"]},{"url":"https://bugzilla.suse.com/1191360","tags":["report"]},{"url":"https://bugzilla.suse.com/1192510","tags":["report"]},{"url":"https://bugzilla.suse.com/1192566","tags":["report"]},{"url":"https://bugzilla.suse.com/1192822","tags":["report"]},{"url":"https://bugzilla.suse.com/1193565","tags":["report"]},{"url":"https://bugzilla.suse.com/1194044","tags":["report"]},{"url":"https://bugzilla.suse.com/1194363","tags":["report"]},{"url":"https://bugzilla.suse.com/1194464","tags":["report"]},{"url":"https://bugzilla.suse.com/1195043","tags":["report"]},{"url":"https://bugzilla.suse.com/1195282","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5427","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221397-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173527","tags":["report"]},{"url":"https://bugzilla.suse.com/1186336","tags":["report"]},{"url":"https://bugzilla.suse.com/1191597","tags":["report"]},{"url":"https://bugzilla.suse.com/1192150","tags":["report"]},{"url":"https://bugzilla.suse.com/1193448","tags":["report"]},{"url":"https://bugzilla.suse.com/1194447","tags":["report"]},{"url":"https://bugzilla.suse.com/1194909","tags":["report"]},{"url":"https://bugzilla.suse.com/1195145","tags":["report"]},{"url":"https://bugzilla.suse.com/1195271","tags":["report"]},{"url":"https://bugzilla.suse.com/1195294","tags":["report"]},{"url":"https://bugzilla.suse.com/1195666","tags":["report"]},{"url":"https://bugzilla.suse.com/1195712","tags":["report"]},{"url":"https://bugzilla.suse.com/1195750","tags":["report"]},{"url":"https://bugzilla.suse.com/1195757","tags":["report"]},{"url":"https://bugzilla.suse.com/1195762","tags":["report"]},{"url":"https://bugzilla.suse.com/1195765","tags":["report"]},{"url":"https://bugzilla.suse.com/1195772","tags":["report"]},{"url":"https://bugzilla.suse.com/1195920","tags":["report"]},{"url":"https://bugzilla.suse.com/1196067","tags":["report"]},{"url":"https://bugzilla.suse.com/1196094","tags":["report"]},{"url":"https://bugzilla.suse.com/1196407","tags":["report"]},{"url":"https://bugzilla.suse.com/1196455","tags":["report"]},{"url":"https://bugzilla.suse.com/1196693","tags":["report"]},{"url":"https://bugzilla.suse.com/1196704","tags":["report"]},{"url":"https://bugzilla.suse.com/1196977","tags":["report"]},{"url":"https://bugzilla.suse.com/1197007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20433","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-20433","description":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","status":"published","published":"2018-12-24T13:00:00Z","modified":"2024-08-05T11:58:19.055Z","updated_at":"2026-11-02T14:35:00.237825Z"}],"euvd":[{"id":"EUVD-2019-0193","description":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","status":"published","published":"2018-12-24T13:00:00Z","modified":"2024-08-05T11:58:19Z","updated_at":"2026-11-03T02:39:30.889297Z"}],"ghsa":[{"id":"GHSA-q485-j897-qc27","title":"XML External Entity Reference in mchange:c3p0","description":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","status":"published","published":"2019-01-07T19:14:34Z","modified":"2023-01-09T05:03:58Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:36:07.581563Z"}],"nvd":[{"id":"CVE-2018-20433","description":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","status":"published","published":"2018-12-24T13:29:00.21Z","modified":"2026-06-17T01:52:50.14Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"CVE-2018-20433","description":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","status":"published","published":"2018-12-24T13:29:00.21Z","modified":"2026-10-24T14:06:59.75556052Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-20433","description":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","status":"published","published":"2018-12-24T13:29:00.21Z","modified":"2026-10-23T18:03:56.911626733Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"GHSA-q485-j897-qc27","title":"XML External Entity Reference in mchange:c3p0","description":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","status":"published","published":"2019-01-07T19:14:34Z","modified":"2024-02-17T05:36:17.856971Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"UBUNTU-CVE-2018-20433","description":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","status":"published","published":"2018-12-24T13:29:00Z","modified":"2025-09-08T16:45:06Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"CLSA-2026-1793965939","title":"TuxCare security update for com.mchange:c3p0 (2 CVEs)","description":"TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.5.2-tuxcare.2.","status":"published","published":"2026-11-06T12:52:20Z","modified":"2026-11-06T19:00:05.244316546Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793966046","title":"TuxCare security update for com.mchange:c3p0 (2 CVEs)","description":"TuxCare rebuilt com.mchange:c3p0 to address 2 CVEs. Fixed in 0.9.2.1-tuxcare.3.","status":"published","published":"2026-11-06T12:54:07Z","modified":"2026-11-06T19:00:04.380393059Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"DLA-1621-1","title":"c3p0 - security update","status":"published","published":"2018-12-28T00:00:00Z","modified":"2026-03-09T01:18:08.160391Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2020-0051","title":"Updated c3p0 packages fix security vulnerabilities","description":"An XML external entity processing vulnerability was found in\nextractXmlConfigFromInputStream function in c3p0 (CVE-2018-20433).\n\nc3p0 version \u003c 0.9.5.4 may be exploited by a billion laughs attack when\nloading XML configuration due to missing protections against recursive\nentity expansion when loading configuration (CVE-2019-5427).\n","status":"published","published":"2020-01-28T07:52:40Z","modified":"2026-04-16T04:42:30.425834118Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:10669-1","title":"c3p0-0.9.5.5-1.3 on GA media","description":"These are all security issues fixed in the c3p0-0.9.5.5-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:10:14.880169Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2022:0798-1","title":"Security update for SUSE Manager Server 4.1","description":"This update fixes the following issues:\n\nc3p0:\n\n- Update to version c3p0 0.9.5.5 and mchange-commons-java 0.2.19\n  * Address CVE-2018-20433\n  * Address CVE-2019-5427 - XML-config parsing related attacks (bsc#1133198)\n  * Properly implement the JDBC 4.1 abort method\n- Build with log4j mapper\n- Enhanced for RHEL8\n\ndhcpd-formula:\n\n- Update to version 0.1.1641480250.d5bd14c\n  * make routers option optional\n- Add arm64 support\n- Update to version 0.1.1615805990.f15c8d9\n\nhub-xmlrpc-api:\n\n- Updated to build on Enterprise Linux 8.\n\npy26-compat-msgpack-python:\n\n- Adapted to build on OBS for Enterprise Linux.\n\npy27-compat-salt:\n\n- Fix inspector module export function (bsc#1097531)\n- Fix possible traceback on ip6_interface grain (bsc#1193565)\n- Don't check for cached pillar errors on state.apply (bsc#1190781)\n- Simplify 'transactional_update' module to not use SSH wrapper and allow more flexible execution\n- Add '--no-return-event' option to salt-call to prevent sending return event back to master.\n- Make 'state.highstate' to acts on concurrent flag.\n- Fix the regression with invalid syntax in test_parse_cpe_name_v23.\n\nspacecmd:\n\n- Version 4.1.17-1\n  * Fix interactive mode for 'system_applyerrata' and 'errata_apply' (bsc#1194363)\n\nspacewalk-java:\n\n- Version 4.1.44-1\n  * allow SCC to display the last check-in time for registered systems\n  * Suggest Product Migration when patch for CVE is in a successor Product (bsc#1191360)\n  * Add store info to Equals and hash methods to fix CVE audit process (bsc#1195282)\n  * fix ClassCastException during action processing (bsc#1195043)\n  * Fix disappearing metadata key files after channel change (bsc#1192822)\n  * Pass only selected servers to taskomatic for cancelation (bsc#1194044)\n\nspacewalk-web:\n\n- Version 4.1.32-1\n  * Suggest Product Migration when patch for CVE is in a successor Product (bsc#1191360)\n\nsusemanager:\n\n- Version 4.1.33-1\n  * set default for registration batch size\n\nsusemanager-doc-indexes:\n\n- Added a warning about the origin of the salt-minion package in the Register on the Command Line (Salt) section of the\n   Client Configuration Guide\n- In the Client Configuration Guide, explain how you find channel names to register older SUSE Linux Enterprise \n  clients.\n- Added grub.cfg for GRUB 2 in the Upgrade chapter of the Client \n\nsusemanager-docs_en:\n\n- Added a warning about the origin of the salt-minion package in the Register on the Command Line (Salt) section of the\n  Client Configuration Guide\n- In the Client Configuration Guide, explain how you find channel \n  names to register older SUSE Linux Enterprise clients.\n- Added grub.cfg for GRUB 2 in the Upgrade chapter of the Client \n  Configuration Guide \n\nsusemanager-schema:\n\n- Version 4.1.25-1\n  * Continue with index migration when the expected indexes do not exist (bsc#1192566)\n\nsusemanager-sls:\n\n- Version 4.1.34-1\n  * Improve `pkgset` beacon with using `salt.cache` to notify about the changes made while the minion was stopped.\n  * Align the code of pkgset beacon to prevent warnings (bsc#1194464)\n- Version 4.1.33-1\n  * Fix errors on calling sed -E ... by force_restart_minion with action chains\n  * Postgres exporter package was renamed\n  * fix deprecation warnings\n  * enforce correct minion configuration similar to bootstrapping (bsc#1192510)\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2022-03-10T11:17:08Z","modified":"2025-05-02T04:29:55.580661Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1397-1","title":"Security update for SUSE Manager Server 4.2","description":"This update fixes the following issues:\n\nc3p0:\n\n- Update to version c3p0 0.9.5.5 and\n  mchange-commons-java 0.2.19\n  * Address CVE-2018-20433\n  * Address CVE-2019-5427 - XML-config parsing related attacks  (bsc#1133198)\n  * Properly implement the JDBC 4.1 abort method\n\ngrafana-formula:\n\n- Version 0.7.0\n  * Add SLES 15 SP4 and openSUSE Leap 15.4 to supported versions\n\nhub-xmlrpc-api:\n\n- Updated to build on Enterprise Linux 8.\n\ninter-server-sync:\n\n- Version 0.1.0\n  * Allow export and import of configuration channels\n  * Clean lookup cache after processing a channel (bsc#1195750)\n  * Improve lookup method for generate foreign key export\n- Adapted for build on Enterprise Linux 8.\n\nmgr-osad:\n\n- Version 4.2.8-1\n  * Fix the condition for preventing building python 2 subpackage for SLE15\n\nmgr-push:\n\n- Version 4.2.5-1\n  * Fix the condition for preventing building python 2 subpackage for SLE15\n\npatterns-suse-manager:\n\n- golang-github-wrouesnel-postgres_exporter was renamed to prometheus-postgres_exporter\n\nprometheus-exporters-formula:\n\n- Version 1.2.0\n  * Postres exporter package was renamed for RedHat\n- Version 1.1.0\n  * Postgres exporter package was renamed for SLES/openSUSE\n\npy26-compat-msgpack-python:\n\n- Adapted to build on OBS for Enterprise Linux.\n\nrhnlib:\n\n- Version 4.2.6-1\n  * Fix the condition for preventing building python 2 subpackage for SLE15\n\nsaltboot-formula:\n\n- Update to version 0.1.1645440615.7f1328c\n  * skip device lookup for correctly provided devices\n  * improve image url modifications - preparation for ftp/http changes \n- Skip device lookup if correct path to device is already provided (bsc#1195757)\n- Improve image url modifications\n\nsmdba:\n\n- Version 1.7.10\n  * adapt pgtune using new defaults for new postgres versions\n  * support special configuration for SSD storage\n  * make argument '--backup-dir' symlink aware \n- Version 1.7.9\n- Allow different standard configuration file location for other OSes\n\nspacecmd:\n\n- Version 4.2.16-1\n  * implement system.bootstrap (bsc#1194909)\n  * Fix interactive mode for 'system_applyerrata' and 'errata_apply' (bsc#1194363)\n\nspacewalk-admin:\n\n- Version 4.2.10-1\n  * wait after copying the CA to give systemd time to finish automation\n\nspacewalk-backend:\n\n- Version 4.2.20-1\n  * Fix reposync update notice formatting and date parsing (bsc#1194447)\n  * implement more decompression algorithms for reposync (bsc#1196704)\n  * enable check for client certificates in reposync\n  * remove auto inherit of host entitlements for virtual guests\n\nspacewalk-branding:\n\n- Version 4.2.13-1\n  * Fix modal footer misalignment\n\nspacewalk-certs-tools:\n\n- Version 4.2.15-1\n  * Add dynamic version for bootstrap script header (bsc#1186336)\n\nspacewalk-client-tools:\n\n- Version 4.2.18-1\n  * Fix the condition for preventing building python 2 subpackage for SLE15\n- Version 4.2.17-1\n  * Update translation strings\n\nspacewalk-config:\n\n- Version 4.2.6-1\n  * Upgrade build tooling, and corresponding cache configuration\n\nspacewalk-java:\n\n- Version 4.2.34-1\n  * Added new XML-RPC mathod: configchannel.syncSaltFilesOnDisk\n  * update last checkin only if job is successful (bsc#1197007)\n  * Fix NPE when accessing cancelled action via system history (bsc#1195762)\n  * CVE Audit: Show patch as available in the currently installed product even if successor\n    patch affects additional packages (bsc#1196455)\n  * send notifications for new or changed ubuntu errata (bsc#1196977)\n  * change directory owner and permissions only when needed\n  * Fixed broken help link for system overview\n  * Provide link to Sync page when unsynced patches message show up (bsc#1196094)\n  * fix class cast exception during action chains (bsc#1195772)\n  * Finding empty profiles by mac address must be case insensitive (bsc#1196407)\n  * prepare to use new postgresql-jdbc driver with stringprep and saslprep support (bsc#1196693)\n  * allow SCC to display the last check-in time for registered systems\n  * generate the system ssh key when bootstrapping a salt-ssh client (bsc#1194909)\n  * Provide link for CVEs\n  * Fix lock/unlock scheduling on page Software Packages Lock (bsc#1195271)\n  * When adding a product, check if the new vendor channels conflicts\n    with any of the existing custom channel (bsc#1193448)\n  * Fix disappearing metadata key files after channel change (bsc#1192822)\n  * Suggest Product Migration when patch for CVE is in a successor Product (bsc#1191360)\n  * Add store info to Equals and hash methods to fix CVE audit process (bsc#1195282)\n  * Fix virtualization list rendering for foreign systems (bsc#1195712)\n  * FIX errors when an image profile / store is deleted during build / inspect action (bsc#1191597, bsc#1192150)\n  * Remove verbose token log (bsc#1195666)\n  * fix ClassCastException during action processing (bsc#1195043)\n\nspacewalk-web:\n\n- Version 4.2.26-1\n  * Provide link to Sync page when unsynced patches message show up (bsc#1196094)\n  * Provide a search box on section name for Formulas content\n  * Add expand/collapse all button for formula sections\n  * Improved large data support in channel selection\n  * Provide link for CVEs\n  * Improved error handling in the product setup page\n  * Suggest Product Migration when patch for CVE is in a successor Product (bsc#1191360)\n  * susemanager-web-libs is now packaged as a part of spacewalk-html\n\nsubscription-matcher:\n\n- Version 0.29\n  * Migration to log4j 2 \n- Version 0.28\n  * Support both antlr3-java and antlr3-runtime as dependencies\n  * Make it obvious that log4j12 is used\n\nsupportutils-plugin-susemanager:\n\n- Version 4.2.4-1\n  * Get version of bootstrap scripts for supportconfig (bsc#1186336)\n\nsuseRegisterInfo:\n\n- Version 4.2.6-1\n  * Fix the condition for preventing building python 2 subpackage for SLE15\n\nsusemanager:\n\n- Version 4.2.28-1\n  * set default for registration batch size\n\nsusemanager-doc-indexes:\n\n- Renamed golang-github-wrouesnel-postgres_exporter to\n  prometheus-postgres_exporter in the Administration Guide\n- Clarified in Client Configuration Guide and Retail Guide that\n  mandatory channels are automatically checked. Also recommended \n  channels as long as they are not deactivated (bsc#1173527)\n- In Custom Channels chapter of the Administration Guide, provide\n  information about creating metadata (bsc#1195294)\n- In the Client Configuration Guide, mark Yomi as unsupported on\n  SUSE Linux Enterprise Server 11 and 12\n- Documented GPG encrypted Salt Pillars in the Salt book\n- In Client Configuration Guide, fixed channel configuration and\n  registration of Expanded Support clients\n- Clarified channel label name in Registering Clients with RHUI\n  section of the Client Configuration Guide (bsc#1196067)\n- In Throubleshooting Synchronization chapter in the Administration\n  Guide added instructions for GPG removal\n- In Client Configuration Guide, integrated SUSE Linux Enterprise \n  Micro Client documentation next to SUSE Linux Enterprise Client  \n  documentation and other related documentation improvements (bsc#1195145)\n- Added a warning about the origin of the salt-minion package in the\n  Register on the Command Line (Salt) section of the Client\n  Configuration Guide\n- Add troubleshooting section about avoiding package conflicts\n  with custom channels\n\nsusemanager-docs_en:\n\n- Renamed golang-github-wrouesnel-postgres_exporter to \n  prometheus-postgres_exporter in the Administration Guide\n- Clarified in Client Configuration Guide and Retail Guide that \n  mandatory channels are automatically checked. Also recommended \n  channels as long as they are not deactivated (bsc#1173527)\n- In Custom Channels chapter of the Administration Guide, provide\n  information about creating metadata (bsc#1195294)\n- In the Client Configuration Guide, mark Yomi as unsupported on \n  SUSE Linux Enterprise Server 11 and 12\n- Documented GPG encrypted Salt Pillars in the Salt book\n- In Client Configuration Guide, fixed channel configuration and \n  registration of Expanded Support clients\n- Clarified channel label name in Registering Clients with RHUI \n  section of the Client Configuration Guide (bsc#1196067)\n- In Throubleshooting Synchronization chapter in the Administration \n  Guide added instructions for GPG removal\n- In Client Configuration Guide, integrated SUSE Linux Enterprise\n  Micro Client documentation next to SUSE Linux Enterprise Client \n  documentation and other related documentation improvements (bsc#1195145)\n- Added a warning about the origin of the salt-minion package in the\n  Register on the Command Line (Salt) section of the Client \n  Configuration Guide\n- Add troubleshooting section about avoiding package conflicts \n  with custom channels\n\nsusemanager-schema:\n\n- Version 4.2.21-1\n  * fix check on allowVendorChange\n  * fix advisory status migration (bsc#1195765)\n  * FIX error when an image profile / store is deleted\n    during build / inspect action (bsc#1191597, bsc#1192150)\n\nsusemanager-sls:\n\n- Version 4.2.21-1\n  * Improve `pkgset` beacon with using `salt.cache`\n    to notify about the changes made while the minion was stopped\n  * Align the code of pkgset beacon to prevent warnings (bsc#1194464)\n  * fixing how the return code is returned in mgrutil runner (bsc#1194909)\n  * Fix errors on calling sed -E ... by force_restart_minion\n    with action chains\n  * Avoid using lscpu -J option in grains (bsc#1195920)\n  * Postgres exporter package was renamed\n  * fix deprecation warnings\n\nvirtualization-formulas:\n\n- Update to version 0.6.2\n  * Ensure qemu-ksm is installed on host\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2022-04-25T14:43:53Z","modified":"2026-02-04T03:25:23.014546Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}