CVE catalog
CVE-2018-20433
c3p0: CVE-2018-20433
- Severity
- High · CVSS 7.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 4.59% · Oct 25, 2026
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | c3p0 | sid | 0.9.1.2-11 | fixed |
| Debian | c3p0 | forky | 0.9.1.2-11 | fixed |
| Debian | c3p0 | trixie | 0.9.1.2-10.1 | fixed |
| Debian | c3p0 | bookworm | 0.9.1.2-10.1~deb12u1 | fixed |
| Suse | c3p0 | manager server module 4.2 | 0.9.5.5-150300.4.6.1 | fixed |
| Suse | grafana-formula | manager server module 4.2 | 0.7.0-150300.3.6.1 | fixed |
| Suse | hub-xmlrpc-api | manager server module 4.2 | 0.7-150300.3.6.1 | fixed |
| Suse | inter-server-sync | manager server module 4.2 | 0.1.0-150300.8.12.1 | fixed |
| Suse | mgr-osad | manager server module 4.2 | 4.2.8-150300.2.9.1 | fixed |
| Suse | mgr-push | manager server module 4.2 | 4.2.5-150300.2.9.1 | fixed |
| Suse | patterns-suse-manager | manager server module 4.2 | 4.2-150300.4.9.1 | fixed |
| Suse | prometheus-exporters-formula | manager server module 4.2 | 1.2.0-150300.3.9.1 | fixed |
| Suse | py26-compat-msgpack-python | manager server module 4.2 | 0.4.6-150300.4.3.1 | fixed |
| Suse | rhnlib | manager server module 4.2 | 4.2.6-150300.4.9.1 | fixed |
| Suse | saltboot-formula | manager server module 4.2 | 0.1.1645440615.7f1328c-150300.3.9.1 | fixed |
| Suse | smdba | manager server module 4.2 | 1.7.10-0.150300.3.3.1 | fixed |
| Suse | spacecmd | manager server module 4.2 | 4.2.16-150300.4.18.1 | fixed |
| Suse | spacewalk-admin | manager server module 4.2 | 4.2.10-150300.3.9.1 | fixed |
| Suse | spacewalk-backend | manager server module 4.2 | 4.2.20-150300.4.18.1 | fixed |
| Suse | spacewalk-branding | manager server module 4.2 | 4.2.13-150300.3.9.1 | fixed |
| Suse | spacewalk-certs-tools | manager server module 4.2 | 4.2.15-150300.3.15.1 | fixed |
| Suse | spacewalk-client-tools | manager server module 4.2 | 4.2.18-150300.4.18.1 | fixed |
| Suse | spacewalk-config | manager server module 4.2 | 4.2.6-150300.3.6.1 | fixed |
| Suse | spacewalk-java | manager server module 4.2 | 4.2.34-150300.3.26.2 | fixed |
| Suse | spacewalk-web | manager server module 4.2 | 4.2.26-150300.3.18.2 | fixed |
| Suse | subscription-matcher | manager server module 4.2 | 0.29-150300.6.6.1 | fixed |
| Suse | supportutils-plugin-susemanager | manager server module 4.2 | 4.2.4-150300.3.6.1 | fixed |
| Suse | suseRegisterInfo | manager server module 4.2 | 4.2.6-150300.4.9.1 | fixed |
| Suse | susemanager | manager server module 4.2 | 4.2.28-150300.3.22.1 | fixed |
| Suse | susemanager-doc-indexes | manager server module 4.2 | 4.2-150300.12.22.1 | fixed |
| Suse | susemanager-docs_en | manager server module 4.2 | 4.2-150300.12.22.1 | fixed |
| Suse | susemanager-schema | manager server module 4.2 | 4.2.21-150300.3.18.1 | fixed |
| Suse | susemanager-sls | manager server module 4.2 | 4.2.21-150300.3.20.1 | fixed |
| Suse | virtualization-formulas | manager server module 4.2 | 0.6.2-150300.8.6.1 | fixed |
| Ubuntu | c3p0 | 14.04 | 0.9.1.2-7 | vulnerable |
| Ubuntu | c3p0 | 14.04 | 0.9.1.2-9 | vulnerable |
| Ubuntu | c3p0 | 14.04 | 0.9.1.2-9+deb8u1build0.14.04.1 | fixed |
| Ubuntu | c3p0 | 16.04 | 0.9.1.2-9 | vulnerable |
| Ubuntu | c3p0 | 16.04 | 0.9.1.2-9+deb8u1build0.16.04.1 | fixed |
| Ubuntu | c3p0 | 18.04 | 0.9.1.2-9 | vulnerable |
| Ubuntu | c3p0 | 18.04 | 0.9.1.2-9+deb8u1build0.18.04.1 | fixed |
| Opensuse | c3p0 | tumbleweed | 0.9.5.5-1.3 | fixed |
| Suse | c3p0 | manager server module 4.1 | 0.9.5.5-3.3.2 | fixed |
| Suse | dhcpd-formula | manager server module 4.1 | 0.1.1641480250.d5bd14c-3.3.2 | fixed |
| Suse | hub-xmlrpc-api | manager server module 4.1 | 0.7-3.9.2 | fixed |
| Suse | py26-compat-msgpack-python | manager server module 4.1 | 0.4.6-3.6.2 | fixed |
| Suse | py27-compat-salt | manager server module 4.1 | 3000.3-6.21.2 | fixed |
| Suse | spacecmd | manager server module 4.1 | 4.1.17-4.36.2 | fixed |
| Suse | spacewalk-java | manager server module 4.1 | 4.1.44-3.66.2 | fixed |
| Suse | spacewalk-web | manager server module 4.1 | 4.1.32-3.42.2 | fixed |
| Suse | susemanager | manager server module 4.1 | 4.1.33-3.45.2 | fixed |
| Suse | susemanager-doc-indexes | manager server module 4.1 | 4.1-11.52.2 | fixed |
| Suse | susemanager-docs_en | manager server module 4.1 | 4.1-11.52.2 | fixed |
| Suse | susemanager-schema | manager server module 4.1 | 4.1.25-3.42.2 | fixed |
| Suse | susemanager-sls | manager server module 4.1 | 4.1.34-3.59.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | c3p0 | source | sid | 0.9.1.2-10 | not yet assigned | Not reported | [917257] |
| Debian | c3p0 | source | forky | 0.9.1.2-10 | not yet assigned | Not reported | [917257] |
| Debian | c3p0 | source | trixie | 0.9.1.2-10 | not yet assigned | Not reported | [917257] |
| Debian | c3p0 | source | bookworm | 0.9.1.2-10 | not yet assigned | Not reported | [917257] |
| Suse | c3p0 | rpm | manager server module 4.2 | 0.9.5.5-150300.4.6.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | grafana-formula | rpm | manager server module 4.2 | 0.7.0-150300.3.6.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | hub-xmlrpc-api | rpm | manager server module 4.2 | 0.7-150300.3.6.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | inter-server-sync | rpm | manager server module 4.2 | 0.1.0-150300.8.12.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | mgr-osad | rpm | manager server module 4.2 | 4.2.8-150300.2.9.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | mgr-push | rpm | manager server module 4.2 | 4.2.5-150300.2.9.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | patterns-suse-manager | rpm | manager server module 4.2 | 4.2-150300.4.9.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | prometheus-exporters-formula | rpm | manager server module 4.2 | 1.2.0-150300.3.9.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | py26-compat-msgpack-python | rpm | manager server module 4.2 | 0.4.6-150300.4.3.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | rhnlib | rpm | manager server module 4.2 | 4.2.6-150300.4.9.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | saltboot-formula | rpm | manager server module 4.2 | 0.1.1645440615.7f1328c-150300.3.9.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | smdba | rpm | manager server module 4.2 | 1.7.10-0.150300.3.3.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | spacecmd | rpm | manager server module 4.2 | 4.2.16-150300.4.18.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | spacewalk-admin | rpm | manager server module 4.2 | 4.2.10-150300.3.9.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | spacewalk-backend | rpm | manager server module 4.2 | 4.2.20-150300.4.18.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | spacewalk-branding | rpm | manager server module 4.2 | 4.2.13-150300.3.9.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | spacewalk-certs-tools | rpm | manager server module 4.2 | 4.2.15-150300.3.15.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | spacewalk-client-tools | rpm | manager server module 4.2 | 4.2.18-150300.4.18.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | spacewalk-config | rpm | manager server module 4.2 | 4.2.6-150300.3.6.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | spacewalk-java | rpm | manager server module 4.2 | 4.2.34-150300.3.26.2 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | spacewalk-web | rpm | manager server module 4.2 | 4.2.26-150300.3.18.2 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | subscription-matcher | rpm | manager server module 4.2 | 0.29-150300.6.6.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | supportutils-plugin-susemanager | rpm | manager server module 4.2 | 4.2.4-150300.3.6.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | suseRegisterInfo | rpm | manager server module 4.2 | 4.2.6-150300.4.9.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | susemanager | rpm | manager server module 4.2 | 4.2.28-150300.3.22.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | susemanager-doc-indexes | rpm | manager server module 4.2 | 4.2-150300.12.22.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | susemanager-docs_en | rpm | manager server module 4.2 | 4.2-150300.12.22.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | susemanager-schema | rpm | manager server module 4.2 | 4.2.21-150300.3.18.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | susemanager-sls | rpm | manager server module 4.2 | 4.2.21-150300.3.20.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Suse | virtualization-formulas | rpm | manager server module 4.2 | 0.6.2-150300.8.6.1 | Not reported | SUSE-SU-2022:1397-1 | Not reported |
| Ubuntu | c3p0 | deb | 14.04 | 0.9.1.2-9+deb8u1build0.14.04.1 | Not reported | UBUNTU-CVE-2018-20433 | Not reported |
| Ubuntu | c3p0 | deb | 16.04 | 0.9.1.2-9+deb8u1build0.16.04.1 | Not reported | UBUNTU-CVE-2018-20433 | Not reported |
| Ubuntu | c3p0 | deb | 18.04 | 0.9.1.2-9+deb8u1build0.18.04.1 | Not reported | UBUNTU-CVE-2018-20433 | Not reported |
| Opensuse | c3p0 | rpm | tumbleweed | 0.9.5.5-1.3 | Not reported | OPENSUSE-SU-2024:10669-1 | Not reported |
| Suse | c3p0 | rpm | manager server module 4.1 | 0.9.5.5-3.3.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | dhcpd-formula | rpm | manager server module 4.1 | 0.1.1641480250.d5bd14c-3.3.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | hub-xmlrpc-api | rpm | manager server module 4.1 | 0.7-3.9.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | py26-compat-msgpack-python | rpm | manager server module 4.1 | 0.4.6-3.6.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | py27-compat-salt | rpm | manager server module 4.1 | 3000.3-6.21.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | spacecmd | rpm | manager server module 4.1 | 4.1.17-4.36.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | spacewalk-java | rpm | manager server module 4.1 | 4.1.44-3.66.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | spacewalk-web | rpm | manager server module 4.1 | 4.1.32-3.42.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | susemanager | rpm | manager server module 4.1 | 4.1.33-3.45.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | susemanager-doc-indexes | rpm | manager server module 4.1 | 4.1-11.52.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | susemanager-docs_en | rpm | manager server module 4.1 | 4.1-11.52.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | susemanager-schema | rpm | manager server module 4.1 | 4.1.25-3.42.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
| Suse | susemanager-sls | rpm | manager server module 4.1 | 4.1.34-3.59.2 | Not reported | SUSE-SU-2022:0798-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [c3p0-javadoc]Unknown
Source package: [c3p0]
Details (1)
0.14.1-1.3· noarch · tumbleweedUnknown · Fixed:
0.9.5.5-1.3Version impact unknown
dsa · c3p0 · opensuse · tumbleweed
- [c3p0]Fixed
Source package: [c3p0]
Details (1)
0.14.1-1.3· noarch · tumbleweedFixed · Fixed:
0.9.5.5-1.3dsa · c3p0 · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [libc3p0-java]Fixed
Source package: [c3p0]
Details (2)
0.9.1.2-10.1~deb12u1· all · bookwormFixed · Fixed:
0.9.1.2-10dsa · c3p0 · debian · bookworm; dsa · c3p0 · debian · 12
0.9.1.2-10.1~deb12u1· all · bookwormFixed · Fixed:
0.9.1.2-10dsa · c3p0 · debian · bookworm; dsa · c3p0 · debian · 12
- [libc3p0-java-doc]Fixed
Source package: [c3p0]
Details (2)
0.9.1.2-10.1~deb12u1· all · bookwormFixed · Fixed:
0.9.1.2-10dsa · c3p0 · debian · bookworm; dsa · c3p0 · debian · 12
0.9.1.2-10.1~deb12u1· all · bookwormFixed · Fixed:
0.9.1.2-10dsa · c3p0 · debian · bookworm; dsa · c3p0 · debian · 12
[Debian 13 (Trixie)]
- [libc3p0-java]Fixed
Source package: [c3p0]
Details (2)
0.9.1.2-10.1· all · trixieFixed · Fixed:
0.9.1.2-10dsa · c3p0 · debian · 13
0.9.1.2-10.1· all · trixieFixed · Fixed:
0.9.1.2-10dsa · c3p0 · debian · 13
- [libc3p0-java-doc]Fixed
Source package: [c3p0]
Details (2)
0.9.1.2-10.1· all · trixieFixed · Fixed:
0.9.1.2-10dsa · c3p0 · debian · 13
0.9.1.2-10.1· all · trixieFixed · Fixed:
0.9.1.2-10dsa · c3p0 · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_0798-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2018-20433]
- [https://osv.dev/vulnerability/DLA-1621-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:0798-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:1397-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2018-20433]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:10669-1]
- [https://security-tracker.debian.org/tracker/CVE-2018-20433]
- [https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-20433.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]