CVE-2018-20433 XML External Entity Reference in mchange:c3p0
An attacker can exploit an XML External Entity vulnerability in c3p0 during initialization to read sensitive files or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20433?
CVE-2018-20433 is a critical vulnerability in Debian Debian Linux, published on 24 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
Weakness: CWE-611
Which versions are affected by CVE-2018-20433?
2 open source packages ship an affected version, including com.mchange:c3p0. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
com.mchange:c3p0 Maven | All versions | 0.9.5.3 |
com.mchange:c3p0 Maven | All versions | 0.9.5.3 |
Linux distribution packages (1)
c3p0 openSUSE:Tumbleweed | All versions | 0.9.5.5-1.3 |
Products include Debian Debian Linux, Mchange C3p0.
How do I fix CVE-2018-20433?
Upgrade com.mchange:c3p0 to 0.9.5.3 or later.
Is CVE-2018-20433 being exploited?
There is no known exploitation of CVE-2018-20433 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-20433, DLA-1621-1, GHSA-q485-j897-qc27, UBUNTU-CVE-2018-20433, openSUSE-SU-2024:10669-1.