XML External Entity Reference in mchange:c3p0

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2018-20433 · ADVISORY
• zhutougg/c3p0 commit 2eb0ea9 · WEB
• GitHub Advisory GHSA-q485-j897-qc27 · ADVISORY
• zhutougg/c3p0 · PACKAGE
• lists.debian.org/debian-lts-announce/2018/12/msg00021.html · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4 · WEB
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4

com.mchange:c3p0 のその他の脆弱性

• CVE-2026-55223中 6.3c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" f…
• CVE-2026-27830高 8.0c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference…
• CVE-2019-5427高 7.5c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursi…