CVE-2018-20433

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

• CWE-611

• https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87bPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/12/msg00021.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/
• https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87bPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/12/msg00021.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/

Published

Dec 24, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20428libming 0.4.8 has a NULL pointer dereference in the strlenex…
• CVE-2018-20429libming 0.4.8 has a NULL pointer dereference in the getName …
• CVE-2018-2043Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-20430GNU Libextractor through 1.8 has an out-of-bounds read vulne…
• CVE-2018-20431GNU Libextractor through 1.8 has a NULL Pointer Dereference …
• CVE-2018-20432D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use…9.8
• CVE-2018-20434LibreNMS 1.46 allows remote attackers to execute arbitrary O…
• CVE-2018-20436The "secret chat" feature in Telegram 4.9.1 for Android has …
• CVE-2018-20437An issue was discovered in the fileDownload function in the …7.5
• CVE-2018-20438Technicolor TC7110.AR STD3.38.03 devices allow remote attack…
• CVE-2018-20439Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-17021…
• CVE-2018-2044Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…