{"id":"CVE-2018-20433","details":"c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.","aliases":["GHSA-q485-j897-qc27"],"modified":"2026-08-07T14:31:33.491471Z","published":"2018-12-24T13:29:00.210Z","related":["SUSE-SU-2022:0798-1","SUSE-SU-2022:1397-1","openSUSE-SU-2024:10669-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2018/12/msg00021.html"},{"type":"FIX","url":"https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/swaldman/c3p0","events":[{"introduced":"9f97c814aef31b2997d6ecfad1e3875c6136317b"},{"last_affected":"9f97c814aef31b2997d6ecfad1e3875c6136317b"}],"database_specific":{"cpe":"cpe:2.3:a:mchange:c3p0:0.9.5.2:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.9.5.2"},{"last_affected":"0.9.5.2"}],"source":"CPE_STRING"}}],"versions":["0.9.5.2","c3p0-0.9.5.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20433.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/zhutougg/c3p0","events":[{"introduced":"9f97c814aef31b2997d6ecfad1e3875c6136317b"},{"last_affected":"9f97c814aef31b2997d6ecfad1e3875c6136317b"},{"fixed":"2eb0ea97f745740b18dd45e4a909112d4685f87b"}],"database_specific":{"cpe":"cpe:2.3:a:mchange:c3p0:0.9.5.2:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.9.5.2"},{"last_affected":"0.9.5.2"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.9.5.2","c3p0-0.9.5.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20433.json","vanir_signatures_modified":"2026-08-07T14:31:33Z","vanir_signatures":[{"target":{"file":"src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java","function":"extractXmlConfigFromInputStream"},"deprecated":false,"digest":{"length":184,"function_hash":"285633924274454538166616215983368224587"},"id":"CVE-2018-20433-5da07470","signature_type":"Function","signature_version":"v1","source":"https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87b"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87b","target":{"file":"src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java"},"deprecated":false,"digest":{"line_hashes":["189690253779608637118636279419339185924","203546079303241071003653587684751722518","82634546918609591678268069562506055393","1203531496525078502927178182878650541"],"threshold":0.9},"id":"CVE-2018-20433-7052ecb0"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}