CVE-2020-25638

HIGH7.4EPSS 0.68%

libhibernate3-java - security update

Published: 2/9/2022Modified: 3/9/2026

Also known as:DSA-4908-1DEBIAN-CVE-2020-25638

Description

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

Affected packages (4)

Debian/libhibernate3-javafrom 0, < 3.6.10.Final-11
Debian/libhibernate3-javafrom 0, < 3.6.10.Final-6+deb9u1
Debian/libhibernate3-javafrom 0, < 3.6.10.Final-9+deb10u1
Maven/org.hibernate:hibernate-core>= 5.4.0.Final, < 5.4.24.Final

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References (14)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-25638
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-25638
PATCHhttps://github.com/hibernate/hibernate-orm
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=1881353
WEBhttps://github.com/hibernate/hibernate-orm/commit/36ebf7d3836e83e99f2a91777b5389e1daf1f2b7
WEBhttps://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78
WEBhttps://github.com/hibernate/hibernate-orm/commit/d22bbb5c339c9df7712c3365bb1df97c91b35ec5
WEBhttps://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44@%3Cdev.turbine.apache.org%3E
WEBhttps://lists.apache.org/thread.html/rf2378209c676a28b71f9b604a3b3517c448540b85367160e558ef9df@%3Ccommits.turbine.apache.org%3E
WEBhttps://lists.debian.org/debian-lts-announce/2021/01/msg00000.html
WEBhttps://www.debian.org/security/2021/dsa-4908
WEBhttps://www.oracle.com/security-alerts/cpuapr2022.html
WEBhttps://www.oracle.com//security-alerts/cpujul2021.html
WEBhttps://www.oracle.com/security-alerts/cpujul2022.html