API Gateway c3p0 vulnerability
search cancel

API Gateway c3p0 vulnerability

book

Article ID: 201909

calendar_today

Updated On:

Products

CA API Gateway API SECURITY CA API Gateway Precision API Monitoring Module for API Gateway (Layer 7) CA API Gateway Enterprise Service Manager (Layer 7) STARTER PACK-7 CA Microgateway

Issue/Introduction

Is the layer7 gateway vulnerable to CVE-2018-20433, c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

Environment

Release : 9.4

Component : API GATEWAY

Resolution

Gateway is not affected by the vulnerability as it doesn't use the XML configuration for c3p0.

Powered by Wolken Software