CVE-2019-10219 — The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

Description

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Affected products

Vendor	Product	Affected	Fixed
Hibernate	hibernate-validator	6.0.0.Alpha1 – ≤ 6.0.17.Final, 6.1.0.Alpha1 – ≤ 6.1.0.Alpha6	6.0.18.Final

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libhibernate-validator-java	No fix yet	—
Debian 13	libhibernate-validator-java	No fix yet	—
Debian 12	libhibernate-validator-java	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	libhibernate-validator-java	No fix yet	—
Ubuntu 26.04 LTS	libhibernate-validator-java	No fix yet	—
Ubuntu 25.10	libhibernate-validator-java	No fix yet	—
Ubuntu 24.04 LTS	libhibernate-validator-java	No fix yet	—
Ubuntu 22.04 LTS	libhibernate-validator-java	No fix yet	—

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	libhibernate-validator-java	No fix yet	—
Ubuntu 18.04 LTS	libhibernate-validator-java	No fix yet	—
Ubuntu 16.04 LTS	libhibernate-validator-java	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat Satellite Capsule 6	ansible-collection-redhat-satellite +1	1.3.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	ansible-runner +1	1.4.6-1.el7ar	RHSA-2020:4366
Red Hat Satellite Capsule 6	ansiblerole-foreman_scap_client	0.0.5-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	ansiblerole-insights-client	1.7.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	ansiblerole-satellite-receptor-installer	0.6.13-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	crane-selinux +1	3.4.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	createrepo_c +1	0.7.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman +1	2.1.2.19-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman-bootloaders-redhat +1	202005201200-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman-discovery-image	1:3.6.7-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman-discovery-image-service +1	1.0.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman-installer +1	1:2.1.2.8-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	foreman-proxy +1	2.1.2-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	future +1	0.16.0-11.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	gofer +2	2.12.5-7.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	hfsplus-tools	332.14-12.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	katello +3	3.16.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	katello-certs-tools	2.7.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	katello-client-bootstrap	1.7.5-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	kobo	0.5.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	libmodulemd	1.7.0-1.pulp.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	libsolv +1	0.7.4-4.pulp.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	libwebsockets	2.4.2-2.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	livecd-tools +1	1:20.4-1.6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	mod_xsendfile	0.12-11.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	ostree	2017.1-2.atomic.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	pulp +14	2.21.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pulp-docker +3	3.2.7-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pulp-katello	1.0.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pulp-ostree +3	1.3.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pulp-rpm +8	2.21.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	puppet-agent	6.14.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	puppet-agent-oauth	0.5.1-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	puppet-foreman_scap_client	0.4.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	puppetlabs-stdlib	4.25.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	puppetserver	6.13.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pycairo	1.16.3-9.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	pygobject3 +2	3.28.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-amqp +1	2.2.2-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-anyjson +1	0.3.3-11.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-apypie +1	0.2.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-billiard +1	1:3.5.0.3-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-blinker	1.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-bson +2	3.2-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-celery +1	4.0.2-9.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-click +1	6.7-9.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-crane +1	3.3.1-9.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-daemon +1	2.1.2-7.el7at	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-django +1	1.11.29-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-flask +1	1:0.12.2-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-gnupg	0.3.7-1.el7ui	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-isodate +1	0.5.4-12.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-itsdangerous +1	0.24-15.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-jinja2 +1	2.10-10.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-jmespath +1	0.9.0-6.el7_7	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-kid	0.9.6-11.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-kombu +1	10:4.0.2-13.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-lockfile +1	1:0.11.0-10.el7ar	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-markupsafe +1	0.23-21.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-mongoengine	0.10.5-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-nectar	1.6.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-oauth2	1.5.211-8.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-okaara +1	1.0.37-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-pexpect +1	4.6-1.el7at	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-psutil	5.0.1-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-ptyprocess +1	0.5.2-3.el7at	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-pycurl +1	7.43.0.2-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-qpid	1.35.0-5.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-semantic_version	2.2.0-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-simplejson	3.2.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-twisted +1	16.4.1-12.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-vine +1	10:1.1.3-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-werkzeug +1	0.12.2-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	python-zope-interface	4.0.5-4.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	qpid-cpp +6	1.36.0-28.el7amq	RHSA-2020:4366
Red Hat Satellite Capsule 6	qpid-dispatch +2	1.5.0-4.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	qpid-proton +2	0.28.0-3.el7	RHSA-2020:4366
Red Hat Satellite Capsule 6	redhat-access-insights-puppet	1.0.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	repoview	0.6.6-11.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	rubygem-fast_gettext	1.1.0-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	rubygem-highline	1.7.8-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	rubygem-newt	0.9.6-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	rubygem-oauth	0.5.4-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	saslwrapper +1	0.22-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	satellite +3	6.8.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	satellite-installer	6.8.0.11-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm +1	6.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-algebrick	0.7.3-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-ansi	1.5.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-apipie-params	0.0.5-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-bundler_ext	0.4.1-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-clamp	1.1.2-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-concurrent-ruby	1:1.1.6-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-concurrent-ruby-edge	1:0.6.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-domain_name	0.5.20160310-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-dynflow	1.4.7-1.fm2_1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-faraday	0.15.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-faraday_middleware	0.13.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-ffi	1.12.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-foreman-tasks-core	0.3.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-foreman_ansible_core	3.0.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-gssapi	1.2.0-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-hashie	3.6.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-highline	1.7.8-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-http-cookie	1.0.2-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-infoblox	3.0.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-journald-logger	2.0.4-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-journald-native	1.0.11-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-jwt	2.2.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-kafo	4.1.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-kafo_parsers	1.1.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-kafo_wizards	0.0.1-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-little-plugger	1.1.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-logging	2.2.2-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-logging-journald	2.0.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-mime-types	3.2.2-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-mime-types-data	3.2018.0812-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-multi_json	1.14.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-multipart-post	2.0.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-mustermann	1.0.2-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh	4.2.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh-krb	0.4.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-netrc	0.11.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-openscap	0.4.9-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-powerbar	2.0.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rack	2.2.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rb-inotify	0.9.7-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rest-client	2.0.2-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rkerberos	0.1.5-18.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rsec	0.4.3-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-ruby-libvirt	0.7.0-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-rubyipmi	0.10.0-6.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-sequel	5.7.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-sinatra +1	2.0.3-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_ansible	3.0.1-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_dhcp_infoblox	0.0.16-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_dhcp_remote_isc	0.0.5-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_discovery	1.0.5-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_discovery_image	1.2.1-1.fm2_1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_dns_infoblox	1.0.0-7.fm2_1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_dynflow	0.2.4-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_dynflow_core	0.2.6-1.fm2_1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_openscap	0.7.3-1.fm2_1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_pulp	2.1.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-smart_proxy_remote_execution_ssh	0.3.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-sqlite3	1.3.13-5.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-statsd-instrument	2.1.4-2.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-tilt	2.0.8-4.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-unf	0.1.3-7.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-unf_ext	0.0.7.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite Capsule 6	tfm-rubygem-xmlrpc	0.3.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	ansible-collection-redhat-satellite	1.3.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	ansible-runner	1.4.6-1.el7ar	RHSA-2020:4366
Red Hat Satellite 6	ansiblerole-foreman_scap_client	0.0.5-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	ansiblerole-insights-client	1.7.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	ansiblerole-satellite-receptor-installer	0.6.13-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	candlepin +1	3.1.21-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	crane-selinux +1	3.4.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	createrepo_c +1	0.7.4-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman +13	2.1.2.19-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-bootloaders-redhat +1	202005201200-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-discovery-image	1:3.6.7-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-discovery-image-service +1	1.0.0-3.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-installer +1	1:2.1.2.8-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-proxy +1	2.1.2-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	foreman-selinux	2.1.2.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	future	0.16.0-11.el7sat	RHSA-2020:4366
Red Hat Satellite 6	gofer +2	2.12.5-7.el7sat	RHSA-2020:4366
Red Hat Satellite 6	hfsplus-tools	332.14-12.el7	RHSA-2020:4366
Red Hat Satellite 6	katello +3	3.16.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	katello-certs-tools	2.7.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	katello-client-bootstrap	1.7.5-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	keycloak-httpd-client-install	1.2.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	kobo	0.5.1-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	libmodulemd	1.7.0-1.pulp.el7sat	RHSA-2020:4366
Red Hat Satellite 6	libsolv	0.7.4-4.pulp.el7sat	RHSA-2020:4366
Red Hat Satellite 6	libwebsockets	2.4.2-2.el7	RHSA-2020:4366
Red Hat Satellite 6	livecd-tools +1	1:20.4-1.6.el7sat	RHSA-2020:4366
Red Hat Satellite 6	mod_passenger	4.0.18-24.el7sat	RHSA-2020:4366
Red Hat Satellite 6	mod_xsendfile	0.12-11.el7sat	RHSA-2020:4366
Red Hat Satellite 6	ostree	2017.1-2.atomic.el7	RHSA-2020:4366
Red Hat Satellite 6	pcp-mmvstatsd	0.4-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pulp +4	2.21.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pulp-docker +2	3.2.7-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pulp-katello	1.0.3-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pulp-ostree +2	1.3.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pulp-rpm +6	2.21.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	puppet-agent	6.14.0-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	puppet-agent-oauth	0.5.1-3.el7sat	RHSA-2020:4366
Red Hat Satellite 6	puppet-foreman_scap_client	0.4.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	puppetlabs-stdlib	4.25.1-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	puppetserver	6.13.0-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pycairo	1.16.3-9.el7sat	RHSA-2020:4366
Red Hat Satellite 6	pygobject3	3.28.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-aiohttp	3.6.2-4.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-amqp	2.2.2-5.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-anyjson	0.3.3-11.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-apypie	0.2.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-async-timeout	3.0.1-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-attrs	19.3.0-3.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-billiard	1:3.5.0.3-3.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-blinker	1.3-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-bson	3.2-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-celery	4.0.2-9.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-chardet	3.0.4-10.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-click	6.7-9.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-crane	3.3.1-9.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-daemon	2.1.2-7.el7at	RHSA-2020:4366
Red Hat Satellite 6	python-dateutil	2.8.1-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-django	1.11.29-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-flask	1:0.12.2-4.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-gnupg	0.3.7-1.el7ui	RHSA-2020:4366
Red Hat Satellite 6	python-idna	2.4-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-idna-ssl	1.1.0-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-isodate	0.5.4-12.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-itsdangerous	0.24-15.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-jinja2	2.10-10.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-jmespath	0.9.0-6.el7_7	RHSA-2020:4366
Red Hat Satellite 6	python-kid	0.9.6-11.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-kombu	10:4.0.2-13.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-lockfile	1:0.11.0-10.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-markupsafe	0.23-21.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-mongoengine	0.10.5-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-multidict	4.7.4-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-nectar	1.6.2-1.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-oauth2	1.5.211-8.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-okaara	1.0.37-2.el7sat	RHSA-2020:4366
Red Hat Satellite 6	python-pexpect	4.6-1.el7at	RHSA-2020:4366
Red Hat Satellite 6	python-prometheus-client	0.7.1-2.el7ar	RHSA-2020:4366
Red Hat Satellite 6	python-psutil	5.0.1-3.el7sat	RHSA-2020:4366
Red Hat JBoss EAP 7	eap7-apache-cxf +3	3.2.11-1.redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.3.5-6.SP3_redhat_00004.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-hal-console	3.0.19-1.Final_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-hibernate +4	5.3.14-1.Final_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-hibernate-validator +1	6.0.18-1.Final_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-jackson-core +9	2.9.10-1.redhat_00003.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-jackson-databind	2.9.10.1-1.redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-jackson-modules-base +1	2.9.10-2.redhat_00003.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-jberet +1	1.3.5-1.Final_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-jboss-ejb-client	4.0.27-1.Final_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-jboss-jsf-api_2.3_spec	2.3.5-3.SP2_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-jboss-server-migration +23	1.3.1-7.Final_redhat_00007.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-jboss-xnio-base	3.7.6-3.SP2_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-netty +1	4.1.42-1.Final_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-picketlink-bindings +1	2.5.5-21.SP12_redhat_00010.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-undertow	2.0.28-2.SP1_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-undertow-jastow	2.0.8-1.Final_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-weld-ejb +6	3.0.6-3.Final_redhat_00003.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-wildfly +2	7.2.6-5.GA_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.0.18-2.Final_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk8 +1	7.2.6-5.GA_redhat_00001.1.el7eap	RHSA-2020:0160
Red Hat JBoss EAP 7	eap7-wildfly-transaction-client	1.1.8-1.Final_redhat_00001.1.el6eap	RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

shoucheng3/hibernate__hibernate-validator_CVE-2019-10219_6_0_18_Final_fixed ★ 0 · Sep 6, 2025
shoucheng3/hibernate__hibernate-validator_CVE-2019-10219_6-0-17-Final ★ 0 · Aug 19, 2025

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.hibernate:hibernate-validator	>= 6.1.0.Alpha1, < 6.1.0.Alpha6	6.1.0.Alpha6	GHSA-m8p2-495h-ccmh
Maven	org.hibernate:hibernate-validator	>= 6.0.0.Alpha1, < 6.0.18.Final	6.0.18.Final	GHSA-m8p2-495h-ccmh
Maven	org.hibernate.validator:hibernate-validator	>= 6.1.0.Alpha1, < 6.1.0.Alpha6	6.1.0.Alpha6	GHSA-m8p2-495h-ccmh
Maven	org.hibernate.validator:hibernate-validator	>= 6.0.0.Alpha1, < 6.0.18.Final	6.0.18.Final	GHSA-m8p2-495h-ccmh

Advisories 6

RHSA-2020:4366 Red Hat Security Advisory: Satellite 6.8 release Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:0160 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:0161 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:0159 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025

References

[accumulo-notifications] 20200108 [GitHub] [accumulo] milleruntime opened a new pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219 mailing-list
[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime closed pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219 mailing-list
[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime commented on issue #1469: Update hibernate-validator. Fixes CVE-2019-10219 mailing-list
RHSA-2020:0164 vendor-advisory
RHSA-2020:0159 vendor-advisory
RHSA-2020:0160 vendor-advisory
RHSA-2020:0161 vendor-advisory
RHSA-2020:0445 vendor-advisory
[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219 mailing-list
[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219 mailing-list
[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-791 Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219 mailing-list
https://www.oracle.com/security-alerts/cpujan2022.html
Upstream fix commit patch
Upstream fix commit patch
Proof of Concept exploit
Proof of Concept exploit
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219
https://security.netapp.com/advisory/ntap-20220210-0024/

CNA	v3.0	6.5
EUVD	v3.0	6.5
OSV:GHSA	v3.0	6.5