CVE-2020-25638 SQL injection in hibernate-core
SQL injection in Hibernate JPA Criteria API allows attackers to access unauthorized data or modify information via unsanitized literals in SQL comments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25638?
CVE-2020-25638 is a high-severity SQL injection vulnerability in Debian Debian Linux, published on 2 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
Weakness: CWE-89
Which versions are affected by CVE-2020-25638?
4 open source packages ship an affected version, including org.hibernate:hibernate-core. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
org.hibernate:hibernate-core Maven | All versions | 5.3.20.Final |
org.hibernate:hibernate-core Maven | All versions | 5.3.20.Final |
org.hibernate:hibernate-core Maven | From 5.4.0.Final | 5.4.24.Final |
org.hibernate:hibernate-core Maven | From 5.4.0.Final | 5.4.24.Final |
Linux distribution packages (36)
eap7-hibernate Red Hat:jboss_enterprise_application_platform:7.3::el6 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el6eap |
eap7-hibernate-core Red Hat:jboss_enterprise_application_platform:7.3::el6 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el6eap |
eap7-hibernate-entitymanager Red Hat:jboss_enterprise_application_platform:7.3::el6 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el6eap |
eap7-hibernate-envers Red Hat:jboss_enterprise_application_platform:7.3::el6 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el6eap |
eap7-hibernate-java8 Red Hat:jboss_enterprise_application_platform:7.3::el6 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el6eap |
eap7-hibernate Red Hat:jboss_enterprise_application_platform:7.3::el7 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el7eap |
eap7-hibernate-core Red Hat:jboss_enterprise_application_platform:7.3::el7 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el7eap |
eap7-hibernate-entitymanager Red Hat:jboss_enterprise_application_platform:7.3::el7 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el7eap |
eap7-hibernate-envers Red Hat:jboss_enterprise_application_platform:7.3::el7 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el7eap |
eap7-hibernate-java8 Red Hat:jboss_enterprise_application_platform:7.3::el7 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el7eap |
eap7-hibernate Red Hat:jboss_enterprise_application_platform:7.3::el8 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el8eap |
eap7-hibernate-core Red Hat:jboss_enterprise_application_platform:7.3::el8 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el8eap |
eap7-hibernate-entitymanager Red Hat:jboss_enterprise_application_platform:7.3::el8 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el8eap |
eap7-hibernate-envers Red Hat:jboss_enterprise_application_platform:7.3::el8 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el8eap |
eap7-hibernate-java8 Red Hat:jboss_enterprise_application_platform:7.3::el8 | All versions | 0:5.3.18-2.Final_redhat_00002.1.el8eap |
hibernate5 SUSE:Manager Server Module 4.1 | All versions | 5.3.7-3.6.1 |
mgr-libmod SUSE:Manager Server Module 4.1 | All versions | 4.1.10-3.25.2 |
mgr-osad SUSE:Manager Server Module 4.1 | All versions | 4.1.6-2.12.2 |
prometheus-formula SUSE:Manager Server Module 4.1 | All versions | 0.3.5-3.15.1 |
py27-compat-salt SUSE:Manager Server Module 4.1 | All versions | 3000.3-6.18.1 |
spacecmd SUSE:Manager Server Module 4.1 | All versions | 4.1.16-4.33.2 |
spacewalk-admin SUSE:Manager Server Module 4.1 | All versions | 4.1.11-3.18.2 |
spacewalk-backend SUSE:Manager Server Module 4.1 | All versions | 4.1.30-4.47.2 |
spacewalk-certs-tools SUSE:Manager Server Module 4.1 | All versions | 4.1.20-3.25.2 |
spacewalk-client-tools SUSE:Manager Server Module 4.1 | All versions | 4.1.11-4.18.2 |
spacewalk-java SUSE:Manager Server Module 4.1 | All versions | 4.1.43-3.63.1 |
spacewalk-reports SUSE:Manager Server Module 4.1 | All versions | 4.1.5-3.9.1 |
spacewalk-setup SUSE:Manager Server Module 4.1 | All versions | 4.1.10-3.15.2 |
spacewalk-utils SUSE:Manager Server Module 4.1 | All versions | 4.1.19-3.27.2 |
spacewalk-web SUSE:Manager Server Module 4.1 | All versions | 4.1.31-3.39.1 |
suseRegisterInfo SUSE:Manager Server Module 4.1 | All versions | 4.1.4-4.6.2 |
susemanager SUSE:Manager Server Module 4.1 | All versions | 4.1.32-3.42.2 |
susemanager-doc-indexes SUSE:Manager Server Module 4.1 | All versions | 4.1-11.49.2 |
susemanager-docs_en SUSE:Manager Server Module 4.1 | All versions | 4.1-11.49.1 |
susemanager-schema SUSE:Manager Server Module 4.1 | All versions | 4.1.24-3.39.2 |
susemanager-sls SUSE:Manager Server Module 4.1 | All versions | 4.1.32-3.54.1 |
Products include Debian Debian Linux, Hibernate Hibernate Orm, Oracle Communications Cloud Native Core Console, Oracle Retail Customer Management and Segmentation Foundation, Quarkus Quarkus.
How do I fix CVE-2020-25638?
Upgrade org.hibernate:hibernate-core to a fixed version for your release line: 5.3.20.Final or 5.4.24.Final.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-25638 being exploited?
There is no known exploitation of CVE-2020-25638 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLSA-2026-1768435720, CLSA-2026-1779842927, DEBIAN-CVE-2020-25638, DLA-2512-1, DSA-4908-1, GHSA-j8jw-g6fq-mp7h and 5 more.