Your submission was sent successfully! Close

USN-5293-1: c3p0 vulnerability

21 February 2022

c3p0 could be made to crash if it opened a specially crafted file.

Releases

Packages

  • c3p0 - JDBC Connection pooling library

Details

Aaron Massey discovered that c3p0 could be made to crash when
parsing certain input. An attacker able to modify the application's
XML configuration file could cause a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 21.10
Ubuntu 20.04
Ubuntu 18.04

In general, a standard system update will make all the necessary changes.

References