CVE-2014-3558 — Improper Authentication in Hibernate Validator

Description

ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libhibernate-validator-java	4.2.1-2	—
Debian 13	libhibernate-validator-java	4.2.1-2	—
Debian 12	libhibernate-validator-java	4.2.1-2	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 6	glassfish-jaxb-eap6	2.2.5-22.redhat_9.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	glassfish-jsf-eap6	2.1.28-5.redhat_6.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	hibernate4-eap6 +4	4.2.14-8.SP3_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	hibernate4-validator	4.3.2-1.Final_redhat_1.2.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	hornetq	2.3.21-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	httpcomponents-eap6 +1	7-4.redhat_3.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	httpcore-eap6 +1	4.2.5-4.redhat_3.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	httpmime-eap6 +2	4.2.6-4.redhat_3.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	ironjacamar-eap6 +9	1.0.27-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-as-ee +62	7.4.1-2.Final_redhat_3.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-connector-api_1.6_spec +1	1.0.1-4.Final_redhat_2.2.ep6.el5	RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-ejb-client	1.0.26-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-hal +1	2.2.10-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-interceptors-api_1.1_spec	1.0.1-5.Final_redhat_2.2.ep6.el5	RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-jaxr-api_1.0_spec	1.0.2-5.Final_redhat_2.2.ep6.el5	RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-jaxrs-api_1.1_spec	1.0.1-9.Final_redhat_2.2.ep6.el5	RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-jaxws-api_2.2_spec	2.0.2-6.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-jms-api_1.1_spec +1	1.0.1-12.Final_redhat_2.2.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-jsp-api_2.2_spec	1.0.1-7.Final_redhat_2.2.ep6.el5	RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-marshalling	1.4.8-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-modules	1.3.4-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-remote-naming	1.0.9-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-remoting3	3.3.3-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-saaj-api_1.3_spec	1.0.3-6.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jboss-security-negotiation	2.3.4-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jbossts	1:4.17.22-2.Final_redhat_2.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jbossweb	7.4.9-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	jbossxb2	2.0.3-14.GA_redhat_2.2.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	netty	3.6.9-2.Final_redhat_1.1.ep6.el5	RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	picketlink-bindings	2.5.3-9.SP10_redhat_1.1.ep6.el5	RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	picketlink-federation	2.5.3-10.SP10_redhat_1.1.ep6.el5	RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	resteasy	2.3.8-8.SP2_redhat_3.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	wss4j	1.6.15-2.redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285
Red Hat JBoss EAP 6	xml-security	1.5.6-2.redhat_1.1.ep6.el5	RHSA-2014:1287, RHSA-2014:1286, RHSA-2014:1285

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.hibernate:hibernate-validator	>= 4.1.0, < 4.2.1	4.2.1	GHSA-845h-985r-jrqh
Maven	org.hibernate:hibernate-validator	>= 4.3.0, < 4.3.2	4.3.2	GHSA-845h-985r-jrqh
Maven	org.hibernate:hibernate-validator	>= 5.0.0, < 5.1.2	5.1.2	GHSA-845h-985r-jrqh

Advisories 4

RHSA-2014:1286 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2014:1287 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2014:1285 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026

References

https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3558.yaml
https://hibernate.atlassian.net/browse/HV-912
RHSA-2015:0720 vendor-advisory
RHSA-2014:1288 vendor-advisory
RHSA-2015:0125 vendor-advisory
RHSA-2014:1285 vendor-advisory
RHSA-2014:1286 vendor-advisory
RHSA-2014:1287 vendor-advisory