Description
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Hibernate | Versions before Hibernate ORM 5.3.18, Versions before Hibernate ORM 5.4.18, Versions before Hibernate ORM 5.5.0.Beta1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-dom4j | 2.1.3-1.redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.2.5-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-13.SP3_redhat_00011.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.23-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.17-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.4.19-1.Final_redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.22-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +9 | 2.10.4-1.redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.4-1.redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.6-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 2.3.5-7.SP2_redhat_00005.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.1.15-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.8.10-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-13.Final_redhat_00014.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration-eap7.3-server +6 | 1.7.1-7.Final_redhat_00009.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.6-4.SP3_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.48-1.Final_redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-10.SP9_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.30-4.SP4_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.0.6-4.Final_redhat_00004.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.9-4.GA_redhat_00003.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly-common | 1.5.2-1.Final_redhat_00002.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.10.7-1.Final_redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.22-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.9-4.GA_redhat_00003.1.el7eap | RHSA-2020:3638, RHSA-2020:3462 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.11-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.1 | golang-github-QubitProducts-exporter_exporter | 0.4.0-6.9.4 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | golang-github-prometheus-node_exporter | 1.0.1-3.3.4 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | hibernate5 | 5.3.7-3.3.4 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | hub-xmlrpc-api | 0.7-3.3.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | patterns-suse-manager | 4.1-6.6.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | prometheus-exporters-formula | 0.7.3-3.10.1 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | salt-netapi-client | 0.17.0-15.4.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | spacecmd | 4.1.7-4.6.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | spacewalk-backend | 4.1.15-4.8.4 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | spacewalk-branding | 4.1.10-3.6.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | spacewalk-client-tools | 4.1.6-4.3.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | spacewalk-java | 4.1.20-3.11.8 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | spacewalk-utils | 4.1.12-3.6.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | spacewalk-web | 4.1.18-3.6.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | subscription-matcher | 0.26-3.3.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | susemanager | 4.1.20-3.8.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | susemanager-build-keys | 15.2.1-3.3.2 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | susemanager-docs_en +1 | 4.1-11.12.2 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | susemanager-schema +1 | 4.1.13-3.6.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | susemanager-sls | 4.1.15-3.8.4 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.1 | uyuni-config-formula | 0.1-6.3.3 | SUSE-SU-2020:2832-1 |
| SUSE Manager Server Module 4.0 | hibernate5 | 5.3.7-4.3.2 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | image-sync-formula | 0.1.1595937550.0285244-3.20.2 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | openvpn-formula | 0.1.1-4.6.2 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | prometheus-exporters-formula | 0.7.1-3.10.2 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | salt-netapi-client | 0.17.0-4.6.3 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | saltboot-formula | 0.1.1595937550.0285244-3.19.2 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | spacecmd | 4.0.20-3.19.2 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | spacewalk-admin | 4.0.11-3.12.1 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | spacewalk-certs-tools | 4.0.17-3.21.3 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | spacewalk-java | 4.0.37-3.39.1 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | spacewalk-setup | 4.0.14-3.14.1 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | spacewalk-utils | 4.0.18-3.21.3 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | spacewalk-web | 4.0.23-3.30.3 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | susemanager | 4.0.28-3.36.3 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | susemanager-frontend-libs | 4.0.2-4.3.2 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | susemanager-schema | 4.0.22-3.29.2 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | susemanager-sls | 4.0.29-3.31.3 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | susemanager-sync-data | 4.0.18-3.24.2 | SUSE-SU-2020:2650-1 |
| SUSE Manager Server Module 4.0 | virtualization-host-formula | 0.5-4.12.3 | SUSE-SU-2020:2650-1 |
| SUSE Manager Proxy Module 4.0 | spacecmd | 4.0.20-3.19.2 | SUSE-SU-2020:2650-1 |
| SUSE Manager Proxy Module 4.0 | spacewalk-certs-tools | 4.0.17-3.21.3 | SUSE-SU-2020:2650-1 |
| SUSE Manager Proxy Module 4.0 | spacewalk-proxy | 4.0.14-3.10.3 | SUSE-SU-2020:2650-1 |
| SUSE Manager Proxy Module 4.0 | spacewalk-web | 4.0.23-3.30.3 | SUSE-SU-2020:2650-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | fuse | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
shanika04/hibernate-orm ★ 0 · Jan 6, 2021
CVE-2019-14900
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.hibernate:hibernate-core | < 5.3.18 | 5.3.18 | GHSA-8grg-q944-cch5 |
| Maven | org.hibernate:hibernate-core | >= 5.4.0, < 5.4.18 | 5.4.18 | GHSA-8grg-q944-cch5 |
| Maven | org.hibernate:hibernate-core | >= 5.5.0.Alpha1, < 5.5.0.Beta1 | 5.5.0.Beta1 | GHSA-8grg-q944-cch5 |
Advisories 9
- RHSA-2020:3462 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3463 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3461 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3639 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:3638 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:3637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- SUSE-SU-2020:2650-1 Security update for SUSE Manager Server 4.0 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:2832-1 Security update for SUSE Manager Server 4.1 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1912 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2025