c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-5293-2 advisory.

    USN-5293-1 fixed a vulnerability in c3p0. This update provides the corresponding update for Ubuntu 16.04     ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5293-1 advisory.

    Aaron Massey discovered that c3p0 could be made to crash when parsing certain input. An attacker able to     modify the application's XML configuration file could cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the CPUApr2020 advisory.

  - initDocumentParser in     xml/XMLSchedulingDataProcessor.java in Terracotta Quartz     Scheduler through 2.3.0 allows XXE attacks via a job     description. (CVE-2019-13990)

  - A Polymorphic Typing issue was discovered in FasterXML     jackson-databind 2.0.0 through 2.9.10. When Default     Typing is enabled (either globally or for a specific     property) for an externally exposed JSON endpoint and     the service has the p6spy (3.8.6) jar in the classpath,     and an attacker can find an RMI service endpoint to     access, it is possible to make the service execute a     malicious payload. This issue exists because of     com.p6spy.engine.spy.P6DataSource mishandling.
    (CVE-2019-16943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to version 0.9.5.4.

Resolves CVE-2018-20433 and CVE-2019-5427.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183577	Ubuntu 16.04 ESM : c3p0 vulnerability (USN-5293-2)	Nessus	Ubuntu Local Security Checks	high
158255	Ubuntu 18.04 LTS / 20.04 LTS : c3p0 vulnerability (USN-5293-1)	Nessus	Ubuntu Local Security Checks	high
135584	Oracle Primavera Unifier (Apr 2020 CPU)	Nessus	CGI abuses	critical
125487	Fedora 30 : c3p0 (2019-cb14e234fc)	Nessus	Fedora Local Security Checks	critical
125486	Fedora 29 : c3p0 (2019-063672154a)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2019-5427

high

Tenable Plugins

high

high

critical

critical

critical