Hi there,
I may have discovered a method in the newest version of com.hubspot:SingularityService.jar, which has XXE vulnerability. The vulnerability is located in the method com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils.extractXmlConfigFromInputStream(InputStream is) . The vulnerability bears similarities to a recent CVE disclosure CVE-2018-20433 in the "zhutougg/c3p0" project.
The source vulnerability information is as follows:
Vulnerability Detail:
CVE Identifier: CVE-2018-20433
Description: c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2018-20433
Patch: zhutougg/c3p0@2eb0ea9
Affected versions: <= 0.9.5.2
Maybe the c3p0 that the project depends on is a vulnerable version？
Hi there,
I may have discovered a method in the newest version of com.hubspot:SingularityService.jar, which has XXE vulnerability. The vulnerability is located in the method
com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils.extractXmlConfigFromInputStream(InputStream is). The vulnerability bears similarities to a recent CVE disclosure CVE-2018-20433 in the "zhutougg/c3p0" project.The source vulnerability information is as follows:
Maybe the c3p0 that the project depends on is a vulnerable version？