C3p0 CVEs and Security Vulnerabilities

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

CVE-2019-5427

c3p0: loading XML configuration leads to denial of service

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

CVSS 3.1 · 7.5 High EPSS 4.9% KEV · Not listed

Vendors

Fedoraproject Mchange Oracle and 1 more

Products

Fedora C3p0 Communications Ip Service Activator and 9 more

CVE-2018-20433

c3p0: XML external entity processing in extractXmlConfigFromInputStream

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

CVSS 3.0 · 9.8 Critical EPSS 4.6% KEV · Not listed

Vendors

Debian Mchange

Products

Debian Linux C3p0

Page 1 of 1.