MGASA-2020-0051

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2020-0051.html
Import Source
https://advisories.mageia.org/MGASA-2020-0051.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2020-0051
Related
Published
2020-01-28T07:52:40Z
Modified
2020-01-28T07:27:17Z
Summary
Updated c3p0 packages fix security vulnerabilities
Details

An XML external entity processing vulnerability was found in extractXmlConfigFromInputStream function in c3p0 (CVE-2018-20433).

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration (CVE-2019-5427).

References
Credits

Affected packages

Mageia:7 / c3p0

Package

Name
c3p0
Purl
pkg:rpm/mageia/c3p0?distro=mageia-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.5.4-1.mga7

Ecosystem specific 

{
    "section": "core"
}