Maven/com.mchange:c3p0 CVE-2018-20433: critical 9.8, EPSS 4.59%
XML External Entity Reference in mchange:c3p0
Action: Upgrade com.mchange:c3p0 to 0.9.5.3 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.9.5.3 | - |
Fixed versions
| 0.9.5.3 |
Sources
- osv: GHSA-q485-j897-qc27
- https://nvd.nist.gov/vuln/detail/CVE-2018-20433
- https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87b
- https://github.com/advisories/GHSA-q485-j897-qc27
- https://github.com/zhutougg/c3p0
- https://lists.debian.org/debian-lts-announce/2018/12/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4
CVE-2018-20433 · published · modified · JSON