The vulnerability in c3p0 (prior to 0.14.0) involves unsafe deserialization of untrusted data due to the library supplying a susceptible DataSource/ConnectionPoolDataSource. JavaBean libraries treat getXXX() methods as safe properties, but in this case, they invoke JDBC driver code during deserialization property resolution. Attackers can exploit this by crafting malicious serialized DataSource objects that, when deserialized in an environment with vulnerable JDBC drivers and auto-resolving JavaBean property mechanisms (e.g., Apache commons-beanutils Comparator), trigger deserialization gadget chains. This can lead to potential remote code execution or other impacts depending on the JDBC driver vulnerabilities. The issue is addressed by updating c3p0 to version 0.14.0 or later.

Successful exploitation requires a vulnerable c3p0 version (<0.14.0), a susceptible DataSource or ConnectionPoolDataSource, a vulnerable JDBC driver on the classpath, and a deserialization process that auto-resolves JavaBean properties. The impact includes potential execution of deserialization gadgets leading to unauthorized code execution or other malicious behavior. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low complexity, partial attack and user interaction requirements, and limited confidentiality, integrity, and availability impacts.

A fix is available by upgrading c3p0 to version 0.14.0 or later. Users should update to this version to remediate the vulnerability. No other vendor advisory or temporary fixes are provided. Patch status is confirmed by the vendor stating the issue is fixed in 0.14.0.