SQL Injection Vulnerability in Hibernate Core - libhibernate3-java
Summary
CVE-2020-25638: A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. Affects libhibernate3-java across 2 version ranges.
< 3.6.10.Final-11
< 64be512b7d8e54ff8d2b9f917bc4c03c6f7bd26b
Fixed in 3.6.10.Final-11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hibernate is a popular object-relational mapping (ORM) framework for Java, facilitating the development of database-driven applications. The libhibernate3-java package provides the core functionalities of Hibernate, enabling developers to interact with databases using Java objects. However, certain versions of this package are susceptible to a SQL injection vulnerability that can compromise data integrity and confidentiality.
Vulnerability Detail
A flaw was identified in hibernate-core versions prior to and including 5.4.23.Final, where a SQL injection vulnerability exists in the implementation of the JPA Criteria API. This vulnerability arises when unsanitized literals are allowed in SQL comments of queries, potentially enabling attackers to access unauthorized information or conduct further attacks. The ramifications of this vulnerability are severe, impacting data confidentiality and integrity, with a CVSS score of 7.4 indicating a high level of risk.
How To Fix
Minimum fixed version
3.6.10.Final-11
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libhibernate3-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization in your application to mitigate the risk of SQL injection. Ensure that any user inputs are properly escaped and validated before being used in SQL queries.
Conclusion
The SQL injection vulnerability in libhibernate3-java poses a significant risk to applications using affected versions of the package. Upgrading to a secure version is crucial to protect data integrity and confidentiality. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for libhibernate3-java →
FAQ
The vulnerability is a SQL injection flaw that allows unsanitized literals in SQL comments, potentially leading to unauthorized data access.
Versions prior to and including 3.6.10.Final-11 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application's manifest file for vulnerabilities.
The vulnerability can lead to unauthorized access to sensitive data, data integrity issues, and further attacks on the application.
Yes, implementing input validation and sanitization can help mitigate the risk of SQL injection until an upgrade is possible.
Related vulnerabilities
Recent vulnerabilities recorded for libhibernate3-java.
