CVE-2019-5427

CVE-2019-5427 affects c3p0, where versions older than 0.9.5.4 are vulnerable to a billion laughs (XML entity expansion) attack when loading XML configuration due to missing protections against recursive entity expansion. Public sources in connected documents confirm the issue exists in c3p0

CVE-2018-20433

CVE-2018-20433 affects c3p0 (version 0.9.5.2) via an XML External Entity (XXE) vulnerability in extractXmlConfigFromInputStream() during initialization of C3P0ConfigXmlUtils. Several connected advisories confirm the issue and reference a fix: upgrading to 0.9.5.4 (as reported in Mageia MGASA-2020...