CVE-2019-14900 SQL Injection in Hibernate ORM
SQL injection in Hibernate ORM's JPA Criteria API allows attackers to access unauthorized data or execute further attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14900?
CVE-2019-14900 is a medium-severity SQL injection vulnerability in Redhat Jboss Enterprise Application Platform, published on 6 Jul 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
Weakness: CWE-89
Which versions are affected by CVE-2019-14900?
6 open source packages ship an affected version, including org.hibernate:hibernate-core. It affects 10 products.
| Package | Affected | Fixed in |
|---|---|---|
org.hibernate:hibernate-core Maven | All versions | 5.3.18 |
org.hibernate:hibernate-core Maven | All versions | 5.3.18 |
org.hibernate:hibernate-core Maven | From 5.4.0 | 5.4.18 |
org.hibernate:hibernate-core Maven | From 5.4.0 | 5.4.18 |
org.hibernate:hibernate-core Maven | From 5.5.0.Alpha1 | 5.5.0.Beta1 |
org.hibernate:hibernate-core Maven | From 5.5.0.Alpha1 | 5.5.0.Beta1 |
Linux distribution packages (23)
golang-github-QubitProducts-exporter_exporter SUSE:Manager Server Module 4.1 | All versions | 0.4.0-6.9.4 |
golang-github-prometheus-node_exporter SUSE:Manager Server Module 4.1 | All versions | 1.0.1-3.3.4 |
hibernate5 SUSE:Manager Server Module 4.1 | All versions | 5.3.7-3.3.4 |
hub-xmlrpc-api SUSE:Manager Server Module 4.1 | All versions | 0.7-3.3.3 |
patterns-suse-manager SUSE:Manager Server Module 4.1 | All versions | 4.1-6.6.3 |
prometheus-exporters-formula SUSE:Manager Server Module 4.1 | All versions | 0.7.3-3.10.1 |
salt-netapi-client SUSE:Manager Server Module 4.1 | All versions | 0.17.0-15.4.3 |
spacecmd SUSE:Manager Server Module 4.1 | All versions | 4.1.7-4.6.3 |
spacewalk-backend SUSE:Manager Server Module 4.1 | All versions | 4.1.15-4.8.4 |
spacewalk-branding SUSE:Manager Server Module 4.1 | All versions | 4.1.10-3.6.3 |
spacewalk-certs-tools SUSE:Manager Server Module 4.1 | All versions | 4.1.13-3.6.3 |
spacewalk-client-tools SUSE:Manager Server Module 4.1 | All versions | 4.1.6-4.3.3 |
spacewalk-java SUSE:Manager Server Module 4.1 | All versions | 4.1.20-3.11.8 |
spacewalk-utils SUSE:Manager Server Module 4.1 | All versions | 4.1.12-3.6.3 |
spacewalk-web SUSE:Manager Server Module 4.1 | All versions | 4.1.18-3.6.3 |
subscription-matcher SUSE:Manager Server Module 4.1 | All versions | 0.26-3.3.3 |
susemanager SUSE:Manager Server Module 4.1 | All versions | 4.1.20-3.8.3 |
susemanager-build-keys SUSE:Manager Server Module 4.1 | All versions | 15.2.1-3.3.2 |
susemanager-doc-indexes SUSE:Manager Server Module 4.1 | All versions | 4.1-11.12.2 |
susemanager-docs_en SUSE:Manager Server Module 4.1 | All versions | 4.1-11.12.2 |
susemanager-schema SUSE:Manager Server Module 4.1 | All versions | 4.1.13-3.6.3 |
susemanager-sls SUSE:Manager Server Module 4.1 | All versions | 4.1.15-3.8.4 |
uyuni-config-formula SUSE:Manager Server Module 4.1 | All versions | 0.1-6.3.3 |
Products include Hibernate Hibernate Orm, Quarkus Quarkus, Redhat Build of Quarkus, Redhat Decision Manager, Redhat Fuse, Redhat Jboss Data Grid and 4 more.
How do I fix CVE-2019-14900?
Upgrade org.hibernate:hibernate-core to a fixed version for your release line: 5.3.18, 5.4.18 or 5.5.0.Beta1.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2019-14900 being exploited?
There is no known exploitation of CVE-2019-14900 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLSA-2026-1767917315, CLSA-2026-1783645403, GHSA-8grg-q944-cch5, OESA-2021-1135, OESA-2021-1136, OESA-2021-1137 and 1 more.