Summary
It was discovered that c3p0 was vulnerable to remote code execution via maliciously
crafted serialized objects and JNDI references. An attacker could use this to
execute arbitrary code, bypass security restrictions, or cause a denial of service.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | c3p0 | 0.9.1.2-9+deb8u1ubuntu0.18.04.1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | c3p0 | 0.9.1.2-10ubuntu0.20.04.1+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | c3p0 | 0.9.1.2-10ubuntu1+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | c3p0 | 0.9.1.2-10ubuntu2+esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | c3p0 | 0.9.1.2-11ubuntu0.1~esm1 |
Vulnerabilities 4
-
High 8.9
mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running appl…
-
High 8.9
c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property
c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` whi…
-
High 7.1
mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbi…
-
Medium 6.3
c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection(…