XML External Entity injection in c3p0 - CVE-2018-20433

Vulnerability identifier: #VU18784

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-20433

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input within the extractXmlConfigFromInputStream() method in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java file during initialization. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

c3p0
Apache Camel
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Server
Fedora
inter-server-sync
inter-server-sync-debuginfo
saltboot-formula
py26-compat-msgpack-python
py26-compat-msgpack-python-debuginfo
py26-compat-msgpack-python-debugsource
virtualization-formulas
grafana-formula
hub-xmlrpc-api
c3p0
subscription-matcher
prometheus-exporters-formula
smdba
supportutils-plugin-susemanager
mgr-push
python3-mgr-push
spacewalk-config
python3-suseRegisterInfo
suseRegisterInfo
python3-rhnlib
python3-mgr-osa-dispatcher
python3-mgr-osa-common
mgr-osa-dispatcher
spacewalk-admin
spacewalk-branding
python3-spacewalk-certs-tools
spacewalk-certs-tools
spacecmd
python3-spacewalk-client-tools
spacewalk-client-tools
spacewalk-backend-sql
spacewalk-backend-xmlrpc
spacewalk-backend-xml-export-libs
spacewalk-backend-tools
spacewalk-backend-sql-postgresql
spacewalk-backend-config-files
spacewalk-backend
spacewalk-backend-app
spacewalk-backend-server
spacewalk-backend-applet
spacewalk-backend-config-files-common
spacewalk-backend-config-files-tool
spacewalk-backend-iss
spacewalk-backend-iss-export
spacewalk-backend-package-push-server
susemanager-schema
uyuni-config-modules
susemanager-sls
spacewalk-base-minimal
spacewalk-base-minimal-config
spacewalk-base
spacewalk-html
susemanager
susemanager-tools
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-lib
spacewalk-java-config
spacewalk-java
patterns-suma_server
patterns-suma_retail
susemanager-doc-indexes
susemanager-docs_en
susemanager-docs_en-pdf

Install updates from vendor's website.

c3p0 - update to 0.9.5.3
Apache Camel - update to 2.24.0
inter-server-sync - update to 0.1.0-150300.8.12.1
inter-server-sync-debuginfo - update to 0.1.0-150300.8.12.1
saltboot-formula - update to 0.1.1645440615.7f1328c-150300.3.9.1
py26-compat-msgpack-python - update to 0.4.6-150300.4.3.1
py26-compat-msgpack-python-debuginfo - update to 0.4.6-150300.4.3.1
py26-compat-msgpack-python-debugsource - update to 0.4.6-150300.4.3.1
virtualization-formulas - update to 0.6.2-150300.8.6.1
grafana-formula - update to 0.7.0-150300.3.6.1
hub-xmlrpc-api - update to 0.7-150300.3.6.1
c3p0 - addressed in versions 0.9.5.4-1.fc29, 0.9.5.4-1.fc30
c3p0 - update to 0.9.5.5-150300.4.6.1
subscription-matcher - update to 0.29-150300.6.6.1
prometheus-exporters-formula - update to 1.2.0-150300.3.9.1
smdba - update to 1.7.10-0.150300.3.3.1
supportutils-plugin-susemanager - update to 4.2.4-150300.3.6.1
mgr-push - update to 4.2.5-150300.2.9.1
python3-mgr-push - update to 4.2.5-150300.2.9.1
spacewalk-config - update to 4.2.6-150300.3.6.1
python3-suseRegisterInfo - update to 4.2.6-150300.4.9.1
suseRegisterInfo - update to 4.2.6-150300.4.9.1
python3-rhnlib - update to 4.2.6-150300.4.9.1
python3-mgr-osa-dispatcher - update to 4.2.8-150300.2.9.1
python3-mgr-osa-common - update to 4.2.8-150300.2.9.1
mgr-osa-dispatcher - update to 4.2.8-150300.2.9.1
spacewalk-admin - update to 4.2.10-150300.3.9.1
spacewalk-branding - update to 4.2.13-150300.3.9.1
python3-spacewalk-certs-tools - update to 4.2.15-150300.3.15.1
spacewalk-certs-tools - update to 4.2.15-150300.3.15.1
spacecmd - update to 4.2.16-150300.4.18.1
python3-spacewalk-client-tools - update to 4.2.18-150300.4.18.1
spacewalk-client-tools - update to 4.2.18-150300.4.18.1
spacewalk-backend-sql - update to 4.2.20-150300.4.18.1
spacewalk-backend-xmlrpc - update to 4.2.20-150300.4.18.1
spacewalk-backend-xml-export-libs - update to 4.2.20-150300.4.18.1
spacewalk-backend-tools - update to 4.2.20-150300.4.18.1
spacewalk-backend-sql-postgresql - update to 4.2.20-150300.4.18.1
spacewalk-backend-config-files - update to 4.2.20-150300.4.18.1
spacewalk-backend - update to 4.2.20-150300.4.18.1
spacewalk-backend-app - update to 4.2.20-150300.4.18.1
spacewalk-backend-server - update to 4.2.20-150300.4.18.1
spacewalk-backend-applet - update to 4.2.20-150300.4.18.1
spacewalk-backend-config-files-common - update to 4.2.20-150300.4.18.1
spacewalk-backend-config-files-tool - update to 4.2.20-150300.4.18.1
spacewalk-backend-iss - update to 4.2.20-150300.4.18.1
spacewalk-backend-iss-export - update to 4.2.20-150300.4.18.1
spacewalk-backend-package-push-server - update to 4.2.20-150300.4.18.1
susemanager-schema - update to 4.2.21-150300.3.18.1
uyuni-config-modules - update to 4.2.21-150300.3.20.1
susemanager-sls - update to 4.2.21-150300.3.20.1
spacewalk-base-minimal - update to 4.2.26-150300.3.18.2
spacewalk-base-minimal-config - update to 4.2.26-150300.3.18.2
spacewalk-base - update to 4.2.26-150300.3.18.2
spacewalk-html - update to 4.2.26-150300.3.18.2
susemanager - update to 4.2.28-150300.3.22.1
susemanager-tools - update to 4.2.28-150300.3.22.1
spacewalk-taskomatic - update to 4.2.34-150300.3.26.2
spacewalk-java-postgresql - update to 4.2.34-150300.3.26.2
spacewalk-java-lib - update to 4.2.34-150300.3.26.2
spacewalk-java-config - update to 4.2.34-150300.3.26.2
spacewalk-java - update to 4.2.34-150300.3.26.2
patterns-suma_server - update to 4.2-150300.4.9.1
patterns-suma_retail - update to 4.2-150300.4.9.1
susemanager-doc-indexes - update to 4.2-150300.12.22.1
susemanager-docs_en - update to 4.2-150300.12.22.1
susemanager-docs_en-pdf - update to 4.2-150300.12.22.1

• https://github.com/zhutougg/c3p0/commit/2eb0ea97f745740b18dd45e4a909112d4685f87b
• https://lists.debian.org/debian-lts-announce/2018/12/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/

• XXE in c3p0 JDBC3 connector
• Apache Camel security update
• SUSE update for SUSE Manager Server 4.2
• Fedora 30 update for c3p0
• Fedora 29 update for c3p0