Bug#917257: c3p0: CVE-2018-20433: XXE vulnerability at initialization

[Salvatore Bonaccorso]

Source: c3p0
Version: 0.9.1.2-9
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for c3p0.

CVE-2018-20433[0]:
| c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in
| com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-20433
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20433
[1] https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87b

Regards,
Salvatore