CVE-2018-20433 PUBLISHED

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

EPSS 2.40% · 84.9th percentile

Risk Scores

EPSS Score
2.40%
84.9th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSc3p00, 0.9.1.2-7, 0.9.1.2-9
Ubuntu:16.04:LTSc3p00, 0.9.1.2-9
Ubuntu:18.04:LTSc3p00, 0.9.1.2-9

Timeline

References

Open in Interactive Console →