Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2019-5427 PoC — c3p0 资源管理错误漏洞

Source
Associated Vulnerability
Title:c3p0 资源管理错误漏洞 (CVE-2019-5427)
Description:c3p0是一款支持高并发的开源JDBC连接池库。 c3p0 0.9.5.4之前版本中存在安全漏洞。攻击者可利用该漏洞造成拒绝服务。
Description
version between CVE-2018-20433 and CVE-2019-5427
Readme
#### c3p0 ####

c3p0 is a mature, highly concurrent JDBC Connection pooling library, with
support for caching and reuse of PreparedStatements. It is licensed under 
[LGPL v.2.1](https://github.com/swaldman/c3p0/blob/master/src/dist-static/LICENSE-LGPL)
or [EPL v.1.0](https://github.com/swaldman/c3p0/blob/master/src/dist-static/LICENSE-EPL), 
at your option.

c3p0 is now maintained on [github](https://github.com/swaldman/c3p0).

c3p0 is available as managed dependency on [Sonatype's open-source software repostory](https://oss.sonatype.org/content/repositories/releases/), 
under <code>[groupId: com.mchange, artifactId: c3p0]</code> For available values of <code>version</code>, look [here](https://oss.sonatype.org/content/repositories/releases/com/mchange/c3p0/).

You can still find releases at [sourceforge](http://sourceforge.net/projects/c3p0/).

Documentation is available as part of every distribution, as well as [on-line](http://www.mchange.com/projects/c3p0/).

From the current *development snapshot*, here are the latest [CHANGELOG](https://github.com/swaldman/c3p0/blob/master/src/dist-static/CHANGELOG) and [RELEASE_NOTES](https://github.com/swaldman/c3p0/blob/master/src/dist-static/RELEASE_NOTES-c3p0-0.9.5). For information on how to build from src, checkout [README-SRC](https://github.com/swaldman/c3p0/blob/master/README-SRC).

Please address comments and questions to the [library author](mailto:swaldman@mchange.com), although keep in mind he is an abysmal correspondent and basically an asshole. Despite that, your feedback is very much appreciated. You may also open issues on github and/or sourceforge.

Thank you for your interest in c3p0. I do hope that you find it useful!



File Snapshot

[4.0K] /data/pocs/967351654d5766e4a3ddc87ec038fe667dcfbb10 ├── [2.7K] build.properties ├── [ 36K] build.xml ├── [4.0K] dbms │   └── [4.0K] oracle-thin │   ├── [ 269] build.properties │   ├── [2.4K] build.xml │   └── [4.0K] src │   └── [4.0K] classes │   └── [4.0K] com │   └── [4.0K] mchange │   └── [4.0K] v2 │   └── [4.0K] c3p0 │   └── [4.0K] dbms │   ├── [1.4K] Debug.java │   └── [4.7K] OracleUtils.java ├── [1.1K] LICENSE ├── [ 11K] LICENSE-EPL ├── [ 26K] LICENSE-LGPL ├── [1.7K] README.md ├── [1.2K] README-SRC └── [4.0K] src ├── [4.0K] codegen │   └── [4.0K] com │   └── [4.0K] mchange │   └── [4.0K] v2 │   └── [4.0K] c3p0 │   └── [4.0K] impl │   ├── [4.9K] DriverManagerDataSourceBase.beangen-xml │   ├── [2.7K] JndiRefDataSourceBase.beangen-xml │   ├── [4.0K] old │   │   ├── [3.9K] DriverManagerDataSource.datasource-xml │   │   ├── [3.9K] DriverManagerDataSource.datasource-xml.orig │   │   ├── [3.1K] JndiRefDataSource.datasource-xml │   │   ├── [3.1K] JndiRefDataSource.datasource-xml.orig │   │   ├── [3.9K] PoolBackedDataSourceBase.datasource-xml │   │   ├── [3.9K] PoolBackedDataSource.datasource-xml │   │   ├── [3.9K] PoolBackedDataSource.datasource-xml.orig │   │   ├── [5.7K] WrapperConnectionPoolDataSource.datasource-xml │   │   └── [5.7K] WrapperConnectionPoolDataSource.datasource-xml.orig │   ├── [4.3K] PoolBackedDataSourceBase.beangen-xml │   └── [ 18K] WrapperConnectionPoolDataSourceBase.beangen-xml ├── [4.0K] dist-static │   ├── [107K] CHANGELOG │   ├── [4.0K] examples │   │   ├── [2.6K] c3p0-service.xml │   │   ├── [3.2K] JndiBindDataSource.java │   │   ├── [3.3K] UseJndiDataSource.java │   │   ├── [3.1K] UsePoolBackedDataSource.java │   │   └── [3.1K] UseUnpooledDataSource.java │   ├── [1.1K] LICENSE │   ├── [ 11K] LICENSE-EPL │   ├── [ 26K] LICENSE-LGPL │   ├── [4.0K] old │   │   ├── [2.7K] KNOWN-ISSUES-0.9.0 │   │   ├── [ 18K] LICENSE │   │   ├── [6.3K] README │   │   ├── [ 881] RELEASE-NOTES-0.8.5-pre4.txt │   │   ├── [2.2K] RELEASE-NOTES-0.8.5-pre7.txt │   │   └── [3.1K] RELEASE_NOTES-c3p0-0.9.1-pre7 │   ├── [ 651] README │   ├── [2.3K] RELEASE_NOTES-c3p0-0.9.2 │   ├── [1.5K] RELEASE_NOTES-c3p0-0.9.5.1 │   ├── [4.0K] src │   │   └── [ 548] README │   └── [ 611] TODO ├── [4.0K] doc │   ├── [ 375] arrow_sm.png │   ├── [181K] index.html │   └── [4.0K] old │   └── [ 417] doc-outtakes.html ├── [4.0K] docweb │   ├── [4.0K] docwebapp │   │   └── [4.0K] WEB-INF │   │   ├── [ 240] jboss-web.xml │   │   └── [ 191] web.xml │   └── [4.0K] docwebear │   └── [4.0K] META-INF │   └── [ 369] application.xml ├── [4.0K] java │   └── [4.0K] com │   └── [4.0K] mchange │   └── [4.0K] v2 │   ├── [4.0K] c3p0 │   │   ├── [ 31K] AbstractComboPooledDataSource.java │   │   ├── [2.2K] AbstractConnectionCustomizer.java │   │   ├── [4.1K] AbstractConnectionTester.java │   │   ├── [4.3K] C3P0ProxyConnection.java │   │   ├── [4.4K] C3P0ProxyStatement.java │   │   ├── [ 16K] C3P0Registry.java │   │   ├── [4.0K] cfg │   │   │   ├── [1.4K] C3P0ConfigFinder.java │   │   │   ├── [ 21K] C3P0Config.java │   │   │   ├── [7.0K] C3P0ConfigUtils.java │   │   │   ├── [ 11K] C3P0ConfigXmlUtils.java │   │   │   ├── [5.6K] DefaultC3P0ConfigFinder.java │   │   │   └── [3.2K] NamedScope.java │   │   ├── [4.0K] codegen │   │   │   ├── [8.6K] BeangenDataSourceGenerator.java │   │   │   ├── [2.2K] C3P0ImplUtilsParentLoggerGeneratorExtension.java │   │   │   ├── [ 53K] JdbcProxyGenerator.java │   │   │   └── [2.3K] UnsupportedParentLoggerGeneratorExtension.java │   │   ├── [2.4K] ComboPooledDataSource.java │   │   ├── [3.1K] ConnectionCustomizer.java │   │   ├── [2.5K] ConnectionTester.java │   │   ├── [ 15K] DataSources.java │   │   ├── [4.0K] debug │   │   │   ├── [2.8K] AfterCloseLoggingComboPooledDataSource.java │   │   │   ├── [3.2K] AfterCloseLoggingConnectionWrapper.java │   │   │   ├── [3.0K] CloseLoggingComboPooledDataSource.java │   │   │   ├── [1.9K] CloseLoggingConnectionWrapper.java │   │   │   └── [3.3K] ConstructionLoggingComboPooledDataSource.java │   │   ├── [6.7K] DriverManagerDataSourceFactory.java │   │   ├── [ 11K] DriverManagerDataSource.java │   │   ├── [4.0K] example │   │   │   ├── [2.2K] InitSqlConnectionCustomizer.java │   │   │   └── [1.5K] IsValidOnlyConnectionTester30.java │   │   ├── [4.0K] filter │   │   │   └── [2.2K] FilterDataSource.java │   │   ├── [1.4K] FullQueryConnectionTester.java │   │   ├── [4.0K] impl │   │   │   ├── [2.1K] AbstractC3P0PooledConnection.java │   │   │   ├── [1.9K] AbstractIdentityTokenized.java │   │   │   ├── [ 24K] AbstractPoolBackedDataSource.java │   │   │   ├── [2.3K] AuthMaskingProperties.java │   │   │   ├── [ 10K] C3P0Defaults.java │   │   │   ├── [ 13K] C3P0ImplUtils.java │   │   │   ├── [2.3K] C3P0JavaBeanObjectFactory.java │   │   │   ├── [ 38K] C3P0PooledConnection.java │   │   │   ├── [ 47K] C3P0PooledConnectionPool.java │   │   │   ├── [ 48K] C3P0PooledConnectionPoolManager.java │   │   │   ├── [3.4K] DbAuth.java │   │   │   ├── [ 17K] DefaultConnectionTester.java │   │   │   ├── [2.1K] IdentityTokenizedCoalesceChecker.java │   │   │   ├── [1.4K] IdentityTokenized.java │   │   │   ├── [2.4K] IdentityTokenResolvable.java │   │   │   ├── [1.5K] InternalPooledConnection.java │   │   │   ├── [ 33K] NewPooledConnection.java │   │   │   ├── [1.8K] NullStatementSetManagedResultSet.java │   │   │   ├── [1.5K] ProxyResultSetDetachable.java │   │   │   ├── [5.4K] SetManagedDatabaseMetaData.java │   │   │   ├── [2.0K] SetManagedResultSet.java │   │   │   └── [1.8K] SnatchFromSetResultSet.java │   │   ├── [4.0K] jboss │   │   │   ├── [ 16K] C3P0PooledDataSource.java │   │   │   └── [8.3K] C3P0PooledDataSourceMBean.java │   │   ├── [ 11K] JndiRefConnectionPoolDataSource.java │   │   ├── [5.8K] JndiRefForwardingDataSource.java │   │   ├── [4.0K] management │   │   │   ├── [9.2K] ActiveManagementCoordinator.java │   │   │   ├── [2.9K] C3P0RegistryManager.java │   │   │   ├── [1.9K] C3P0RegistryManagerMBean.java │   │   │   ├── [ 25K] DynamicPooledDataSourceManagerMBean.java │   │   │   ├── [1.6K] ManagementCoordinator.java │   │   │   ├── [1.6K] NullManagementCoordinator.java │   │   │   ├── [5.0K] PooledDataSourceManager.java │   │   │   └── [3.4K] PooledDataSourceManagerMBean.java │   │   ├── [4.0K] mbean │   │   │   ├── [ 13K] C3P0PooledDataSource.java │   │   │   └── [7.2K] C3P0PooledDataSourceMBean.java │   │   ├── [4.0K] off │   │   │   └── [4.0K] servlet │   │   │   └── [5.4K] C3P0StatusServlet.java │   │   ├── [ 27K] PoolBackedDataSourceFactory.java │   │   ├── [1.8K] PoolBackedDataSource.java │   │   ├── [ 25K] PoolConfig.java │   │   ├── [ 18K] PooledDataSource.java │   │   ├── [1.4K] QueryConnectionTester.java │   │   ├── [1.9K] SQLWarnings.java │   │   ├── [4.0K] stmt │   │   │   ├── [3.3K] DoubleMaxStatementCache.java │   │   │   ├── [2.5K] GlobalMaxOnlyStatementCache.java │   │   │   ├── [ 45K] GooGooStatementCache.java │   │   │   ├── [5.6K] MemoryCoalescedStatementCacheKey.java │   │   │   ├── [2.7K] PerConnectionMaxOnlyStatementCache.java │   │   │   ├── [5.2K] SimpleStatementCacheKey.java │   │   │   ├── [4.6K] StatementCacheBenchmark.java │   │   │   ├── [1.8K] StatementCache.java │   │   │   ├── [6.7K] StatementCacheKey.java │   │   │   └── [6.8K] ValueIdentityStatementCacheKey.java │   │   ├── [4.0K] subst │   │   │   └── [1.6K] C3P0Substitutions.java │   │   ├── [4.0K] test │   │   │   ├── [2.4K] AlwaysFailConnectionTester.java │   │   │   ├── [2.4K] AlwaysFailDataSource.java │   │   │   ├── [ 19K] C3P0BenchmarkApp.java │   │   │   ├── [6.7K] ConnectionDispersionTest.java │   │   │   ├── [9.8K] FreezableDriverManagerDataSource.java │   │   │   ├── [4.6K] InterruptedBatchTest.java │   │   │   ├── [2.1K] JavaBeanRefTest.java │   │   │   ├── [3.2K] JndiBindTest.java │   │   │   ├── [2.6K] JndiLookupTest.java │   │   │   ├── [4.0K] junit │   │   │   │   ├── [2.1K] C3P0JUnitTestCaseBase.java │   │   │   │   ├── [3.6K] ConnectionPropertiesResetJUnitTestCase.java │   │   │   │   └── [7.8K] MarshallUnmarshallDataSourcesJUnitTestCase.java │   │   │   ├── [2.0K] ListTablesTest.java │   │   │   ├── [6.7K] LoadPoolBackedDataSource.java │   │   │   ├── [4.4K] OneThreadRepeatedInsertOrQueryTest.java │   │   │   ├── [2.5K] ProxyWrappersTest.java │   │   │   ├── [6.0K] PSLoadPoolBackedDataSource.java │   │   │   ├── [4.1K] RawConnectionOpTest.java │   │   │   ├── [3.4K] StatsTest.java │   │   │   ├── [1.9K] TestConnectionCustomizer.java │   │   │   └── [5.5K] TestRefSerStuff.java │   │   ├── [3.7K] UnifiedConnectionTester.java │   │   ├── [4.0K] util │   │   │   ├── [1.7K] CloseReportingConnectionWrapper.java │   │   │   ├── [2.7K] ConnectionEventSupport.java │   │   │   ├── [5.2K] IsValidOnlyConnectionTester.java │   │   │   ├── [2.7K] StatementEventSupport.java │   │   │   └── [5.8K] TestUtils.java │   │   └── [ 12K] WrapperConnectionPoolDataSource.java │   └── [4.0K] resourcepool │   ├── [ 11K] BasicResourcePoolFactory.java │   ├── [ 82K] BasicResourcePool.java │   ├── [1.6K] CannotAcquireResourceException.java │   ├── [1.8K] EventSupportingResourcePool.java │   ├── [1.6K] NoGoodResourcesException.java │   ├── [2.3K] ResourcePoolEvent.java │   ├── [4.2K] ResourcePoolEventSupport.java │   ├── [1.6K] ResourcePoolException.java │   ├── [6.3K] ResourcePoolFactory.java │   ├── [4.5K] ResourcePool.java │   ├── [1.6K] ResourcePoolListener.java │   ├── [1.9K] ResourcePoolUtils.java │   └── [1.6K] TimeoutException.java ├── [4.0K] maven │   └── [1.5K] pom.xml ├── [4.0K] resources │   └── [ 243] mchange-config-resource-paths.txt └── [4.0K] test-properties ├── [ 388] application.conf ├── [ 30] application.properties ├── [2.2K] c3p0-config.xml ├── [2.8K] c3p0.properties ├── [1.8K] c3p0.properties.rough ├── [ 889] log4j.properties ├── [ 547] logback.xml ├── [3.0K] logging.properties ├── [4.0K] META-INF │   └── [2.0K] poop.xml └── [ 46] other.json 54 directories, 188 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.