Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS04NDVoLTk4NXItanJxaM4AAT03
Improper Authentication in Hibernate Validator
ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.
Permalink: https://github.com/advisories/GHSA-845h-985r-jrqhJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04NDVoLTk4NXItanJxaM4AAT03
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 19 days ago
Identifiers: GHSA-845h-985r-jrqh, CVE-2014-3558
References:
- https://nvd.nist.gov/vuln/detail/CVE-2014-3558
- https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3558.yaml
- https://hibernate.atlassian.net/browse/HV-912
- http://rhn.redhat.com/errata/RHSA-2014-1285.html
- http://rhn.redhat.com/errata/RHSA-2014-1286.html
- http://rhn.redhat.com/errata/RHSA-2014-1287.html
- http://rhn.redhat.com/errata/RHSA-2014-1288.html
- http://rhn.redhat.com/errata/RHSA-2015-0125.html
- http://rhn.redhat.com/errata/RHSA-2015-0720.html
- https://github.com/hibernate/hibernate-validator/commit/2c95d4ea0ef20977be249e31a4a4f4f4f71c945d
- https://github.com/hibernate/hibernate-validator/commit/67fdff14831c035c25e098fe14bd86523d17f726
- https://github.com/hibernate/hibernate-validator/commit/7e7131939a4361a7cad3e77ab89a8462132c561c
- https://github.com/hibernate/hibernate-validator/commit/c489416f699a46859c134796b3ccfea41ef3ce52
- https://github.com/hibernate/hibernate-validator/commit/c9525ca544b1281e2b7c7347e86e87c86dc1dc6e
- https://github.com/hibernate/hibernate-validator/commit/e8c42b689df8c6752d635d02c6518da3fece3870
- https://github.com/hibernate/hibernate-validator/commit/f97c2021a03c825abdeca1692f5be51e77e76a8f
- https://github.com/hibernate/hibernate-validator/commit/fd4eaed7fb930db6a5e4c03742b4b3adcfecc90e
- https://github.com/advisories/GHSA-845h-985r-jrqh
Blast Radius: 0.0
Affected Packages
maven:org.hibernate:hibernate-validator
Dependent packages: 3,342Dependent repositories: 90,621
Downloads:
Affected Version Ranges: >= 5.0.0, < 5.1.2, >= 4.3.0, < 4.3.2, >= 4.1.0, < 4.2.1
Fixed in: 5.1.2, 4.3.2, 4.2.1
All affected versions:
All unaffected versions: