Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

CVE-2018-20433: XXE Vulnerability in c3p0 < 0.9.5.3

Description

From GitHub's vulnerability scanner:

CVE-2018-20433 More information

moderate severity

Vulnerable versions: <= 0.9.5.2
Patched version: 0.9.5.3
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

Acceptance / Success Criteria

None

Lucidchart Diagrams

Activity

Show:

Benjamin Reed May 10, 2019 at 4:12 PM
Edited

This will probably need some manual forward-merges.

Benjamin Reed May 10, 2019 at 3:34 PM

Fixed

Details

Assignee

Reporter

Components

Sprint

Fix versions

Affects versions

Priority

PagerDuty

Created May 10, 2019 at 2:46 PM
Updated May 23, 2019 at 8:11 PM
Resolved May 14, 2019 at 2:29 PM