Eddy-Hoevenaers
commented
4 years ago Bumped Spring Boot version to 2.3.2.RELEASE, this version has a dependency to Hibernate Core 5.4.18.Final
Closed mend-bolt-for-github[bot] closed 4 years ago
Eddy-Hoevenaers
commented
4 years ago Bumped Spring Boot version to 2.3.2.RELEASE, this version has a dependency to Hibernate Core 5.4.18.Final
CVE-2019-14900 - Medium Severity Vulnerability
Hibernate's core ORM functionality
Library home page: http://hibernate.org/orm
Path to dependency file: /tmp/ws-scm/eu-captcha/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/hibernate/hibernate-core/5.4.12.Final/hibernate-core-5.4.12.Final.jar
Dependency Hierarchy: - spring-boot-starter-data-jpa-2.2.5.RELEASE.jar (Root Library) - :x: **hibernate-core-5.4.12.Final.jar** (Vulnerable Library)
Found in HEAD commit: e080b10ef15ba43da06def4764fb4ee87a26706a
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
Publish Date: 2020-07-06
URL: CVE-2019-14900
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14900
Release Date: 2020-07-06
Fix Resolution: org.hibernate:hibernate-core:5.4.18.Final
Step up your Open Source Security Game with WhiteSource here