Description
A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | hibernate-core | Hibernate ORM versions before 5.4.24.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libhibernate3-java | 3.6.10.Final-11 | — |
| Debian 13 | libhibernate3-java | 3.6.10.Final-11 | — |
| Debian 12 | libhibernate3-java | 3.6.10.Final-11 | — |
| Debian 10 | libhibernate3-java | 3.6.10.Final-9+deb10u1 | DSA-4908-1 |
| Debian 9 | libhibernate3-java | 3.6.10.Final-6+deb9u1 | DLA-2512-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libhibernate3-java | 3.6.10.Final-9+deb10u1build0.20.04.1 | USN-6845-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | libhibernate3-java | 3.6.10.Final-9ubuntu0.18.04.1~esm1 | USN-6845-1 |
| Ubuntu Pro 16.04 LTS | libhibernate3-java | 3.6.10.Final-4ubuntu0.1~esm1 | USN-6845-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-glassfish-el +1 | 3.0.1-4.b08_redhat_00005.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hibernate +5 | 5.1.17-3.Final_redhat_00004.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-ejb-client | 4.0.12-1.Final_redhat_00002.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.63-2.Final_redhat_00003.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-16.SP14_redhat_00001.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.11-4.GA_redhat_00002.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron | 1.1.14-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-http-client +4 | 1.0.21-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-naming-client | 1.0.13-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-openssl +1 | 1.0.12-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-openssl-linux | 1.0.12-6.Final_redhat_00001.1.ep7.el7 | RHSA-2025:9582 |
| Red Hat JBoss Web Server 5 | jws5-ecj | 4.12.0-3.redhat_2.2.el7jws | RHSA-2021:2561 |
| Red Hat JBoss Web Server 5 | jws5-mod_cluster +1 | 1.4.3-2.Final_redhat_00002.1.el7jws | RHSA-2021:2561 |
| Red Hat JBoss Web Server 5 | jws5-tomcat +11 | 9.0.43-11.redhat_00011.1.el7jws | RHSA-2021:2561 |
| Red Hat JBoss Web Server 5 | jws5-tomcat-native | 1.2.26-3.redhat_3.el7jws | RHSA-2021:2561 |
| Red Hat JBoss Web Server 5 | jws5-tomcat-vault +1 | 1.1.8-2.Final_redhat_00003.1.el7jws | RHSA-2021:2561 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-6.redhat_00016.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-fge-btf | 1.2.0-1.redhat_00007.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-fge-msg-simple | 1.1.0-1.redhat_00007.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.11-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.18-2.Final_redhat_00002.1.el6eap | RHSA-2020:5175 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.21-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +7 | 2.10.4-1.redhat_00002.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jackson-coreutils | 1.6.0-1.redhat_00006.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jackson-modules-base +1 | 2.10.4-3.redhat_00002.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jasypt | 1.9.3-1.redhat_00002.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jboss-marshalling +1 | 2.0.10-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.19-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-3.Final_redhat_00004.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.11-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.32-1.SP1_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.4-3.GA_redhat_00003.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.9-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.4-3.GA_redhat_00003.1.el7eap | RHSA-2020:5341 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl +1 | 1.0.12-1.Final_redhat_00001.1.el6eap | RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.2 | c3p0 | 0.9.5.2-150300.4.3.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | dhcpd-formula | 0.1.1641480250.d5bd14c-150300.3.3.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | hibernate5 | 5.3.7-150300.5.3.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | inter-server-sync | 0.0.7-150300.8.9.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | mgr-libmod | 4.2.7-150300.3.6.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | mgr-osad | 4.2.7-150300.2.6.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | mgr-push | 4.2.4-150300.2.6.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | py27-compat-salt | 3000.3-150300.7.7.17.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | rhnlib +1 | 4.2.5-150300.4.6.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | salt-netapi-client | 0.19.0-150300.3.3.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | saltboot-formula | 0.1.1637232240.87d79ed-150300.3.6.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | spacecmd | 4.2.15-150300.4.15.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | spacewalk-backend | 4.2.19-150300.4.15.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | spacewalk-branding | 4.2.12-150300.3.6.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | spacewalk-client-tools | 4.2.16-150300.4.15.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | spacewalk-config | 4.2.5-150300.3.3.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | spacewalk-java | 4.2.32-150300.3.20.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | spacewalk-reports | 4.2.7-150300.3.9.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | spacewalk-search +1 | 4.2.6-150300.3.6.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | spacewalk-setup | 4.2.10-150300.3.12.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | spacewalk-utils | 4.2.15-150300.3.12.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | spacewalk-web | 4.2.25-150300.3.15.2 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | susemanager | 4.2.27-150300.3.19.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | susemanager-docs_en +1 | 4.2-150300.12.19.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | susemanager-schema | 4.2.20-150300.3.15.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | susemanager-sls | 4.2.20-150300.3.17.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.2 | uyuni-config-formula | 0.2-150300.3.3.1 | SUSE-SU-2022:0593-1 |
| SUSE Manager Server Module 4.1 | hibernate5 | 5.3.7-3.6.1 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | mgr-libmod | 4.1.10-3.25.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | mgr-osad | 4.1.6-2.12.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | prometheus-formula | 0.3.5-3.15.1 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | py27-compat-salt | 3000.3-6.18.1 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | spacecmd | 4.1.16-4.33.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | spacewalk-admin | 4.1.11-3.18.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | spacewalk-backend | 4.1.30-4.47.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | spacewalk-certs-tools | 4.1.20-3.25.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | spacewalk-client-tools | 4.1.11-4.18.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | spacewalk-java | 4.1.43-3.63.1 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | spacewalk-reports | 4.1.5-3.9.1 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | spacewalk-setup | 4.1.10-3.15.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | spacewalk-utils | 4.1.19-3.27.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | spacewalk-web | 4.1.31-3.39.1 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | suseRegisterInfo | 4.1.4-4.6.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | susemanager | 4.1.32-3.42.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | susemanager-doc-indexes | 4.1-11.49.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | susemanager-docs_en | 4.1-11.49.1 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | susemanager-schema | 4.1.24-3.39.2 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | susemanager-sls | 4.1.32-3.54.1 | SUSE-SU-2022:0225-1 |
| SUSE Manager Server Module 4.1 | uyuni-common-libs | 4.1.10-3.15.1 | SUSE-SU-2022:0225-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.hibernate:hibernate-core | >= 5.4.0.Final, < 5.4.24.Final | 5.4.24.Final | GHSA-j8jw-g6fq-mp7h |
| Maven | org.hibernate:hibernate-core | < 5.3.20.Final | 5.3.20.Final | GHSA-j8jw-g6fq-mp7h |
Advisories 14
- RHSA-2025:9582 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:2561 Red Hat Security Advisory: Red Hat JBoss Web Server 5.5.0 Security release Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2020:5342 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.4 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2020:5340 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.4 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2020:5341 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.4 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2020:5175 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-6845-1 libhibernate3-java vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-4908-1 libhibernate3-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2512-1 libhibernate3-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:0593-1 Security update for SUSE Manager Server 4.2 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1911 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht SQL-Injection BSI CERT-Bund (WID) · Jun 24, 2025
- SUSE-SU-2022:0225-1 Security update for SUSE Manager Server 4.1 SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-0887 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2023-1016 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1881353
- [debian-lts-announce] 20210103 [SECURITY] [DLA 2512-1] libhibernate3-java security update mailing-list
- DSA-4908 vendor-advisory
- https://www.oracle.com//security-alerts/cpujul2021.html
- [turbine-dev] 20211015 Fulcrum Security Hibernate Module mailing-list
- [turbine-commits] 20211018 [turbine-fulcrum-security] 02/02: disable module hibernate (JIRA issue TRB-103), update docs, remove suppression mailing-list
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html