Read the docs
TI-2017-05177 Aliases CVE-2017-7536GHSA-xxgp-pcfc-3vgc

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when…

Priority LOW 31CWE-592Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 16 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

Why it matters now

EPSS 0.00482 41st percentileScored 2026-11-07
Fix Partial org.hibernate:hibernate-validator (Maven): 5.2.5.Final, 5.3.6.Final, 5.4.2.FinalRed Hat: 15 advisoriesRed Hat: 16 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hathibernate-validator5.2.x before 5.2.5 final; 5.3.x; 5.4.x—No fix listedCNA
—org.hibernate:hibernate-validator (Maven)5.2.0 to before 5.2.5.Final5.2.5.FinalPatch availableGHSA-xxgp-pcfc-3vgc
—org.hibernate:hibernate-validator (Maven)5.3.0 to before 5.3.6.Final5.3.6.FinalPatch availableGHSA-xxgp-pcfc-3vgc
—org.hibernate:hibernate-validator (Maven)5.4.0 to before 5.4.2.Final5.4.2.FinalPatch availableGHSA-xxgp-pcfc-3vgc
  • hibernate-validator VendorRed Hat Affected 5.2.x before 5.2.5 final; 5.3.x; 5.4.x Fixed in — No fix listed CNA
  • org.hibernate:hibernate-validator (Maven) Vendor— Affected 5.2.0 to before 5.2.5.Final Fixed in 5.2.5.Final Patch available GHSA-xxgp-pcfc-3vgc
  • org.hibernate:hibernate-validator (Maven) Vendor— Affected 5.3.0 to before 5.3.6.Final Fixed in 5.3.6.Final Patch available GHSA-xxgp-pcfc-3vgc
  • org.hibernate:hibernate-validator (Maven) Vendor— Affected 5.4.0 to before 5.4.2.Final Fixed in 5.4.2.Final Patch available GHSA-xxgp-pcfc-3vgc

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:*5.2.0 to before 5.2.5; 5.3.0 to before 5.3.6; 5.4.0 to before 5.4.2VulnerableRed Hat
cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*6.4VulnerableRed Hat
cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:*6.4VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*6.4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*5.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:*7.1VulnerableRed Hat
  • cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:* Versions 5.2.0 to before 5.2.5; 5.3.0 to before 5.3.6; 5.4.0 to before 5.4.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Red Hat
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
  • cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-xxgp-pcfc-3vgc org.hibernate:hibernate-validator (Maven) Fixed in 5.2.5.Final Advisory →
  • Fix · GHSA-xxgp-pcfc-3vgc org.hibernate:hibernate-validator (Maven) Fixed in 5.3.6.Final Advisory →
  • Fix · GHSA-xxgp-pcfc-3vgc org.hibernate:hibernate-validator (Maven) Fixed in 5.4.2.Final Advisory →

Red Hat 15 advisories

  • RHSA-2018:3817 Released 2018-12-11 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R10 security and bug fix update
    • Red Hat JBoss A-MQ 6.3
    • Red Hat JBoss Fuse 6.3
  • RHSA-2018:2927 Released 2018-10-16 · Red Hat rating Important
    Satellite 6.4 security, bug fix, and enhancement update
    • Red Hat Satellite 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, candlepin-2.4.8-1.el7 +47
    • Red Hat Satellite Capsule 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, createrepo_c-0.7.4-1.el7sat +47
  • RHSA-2018:2743 Released 2018-09-24 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.21 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server codehaus-jackson-1.9.9-14.redhat_7.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-14.redhat_7.1.ep6.el6, codehaus-jackson-jaxrs-1.9.9-14.redhat_7.1.ep6.el6 +47
Show 12 more Red Hat advisories
  • RHSA-2018:2742 Released 2018-09-24 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.21 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server codehaus-jackson-1.9.9-14.redhat_7.1.ep6.el5, codehaus-jackson-core-asl-1.9.9-14.redhat_7.1.ep6.el5, codehaus-jackson-jaxrs-1.9.9-14.redhat_7.1.ep6.el5 +47
  • RHSA-2018:2741 Released 2018-09-24 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.21 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server codehaus-jackson-1.9.9-14.redhat_7.1.ep6.el7, codehaus-jackson-core-asl-1.9.9-14.redhat_7.1.ep6.el7, codehaus-jackson-jaxrs-1.9.9-14.redhat_7.1.ep6.el7 +47
  • RHSA-2018:2740 Released 2018-09-24 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.21 security update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2017:3458 Released 2017-12-13 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el7
  • RHSA-2017:3455 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el7 +47
  • RHSA-2017:3454 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el6 +47
  • RHSA-2017:3456 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss EAP 7.1
  • RHSA-2017:3141 Released 2017-11-07 · Red Hat rating Important
    rhvm-appliance security, bug fix, and enhancement update
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance-1:4.1.20171102.0-1.el7
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-1:4.1.20171102.0-1.el7
  • RHSA-2017:2811 Released 2017-09-26 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.8-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.8-1.GA_redhat_1.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.8-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.8-1.GA_redhat_1.ep7.el7
  • RHSA-2017:2809 Released 2017-09-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-artemis-native-1.1.0-13.redhat_4.ep7.el6, eap7-artemis-native-wildfly-1.1.0-13.redhat_4.ep7.el6, eap7-bouncycastle-1.56.0-3.redhat_2.2.ep7.el6 +31
  • RHSA-2017:2808 Released 2017-09-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-artemis-native-1.1.0-13.redhat_4.ep7.el7, eap7-artemis-native-wildfly-1.1.0-13.redhat_4.ep7.el7, eap7-bouncycastle-1.56.0-3.redhat_2.2.ep7.el7 +31
  • RHSA-2017:2810 Released 2017-09-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss EAP 7.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Virtualization 3AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 6AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse Integration Service 2AffectedNo fix yet
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss Portal 6Affected—
Red Hat OpenShift Enterprise 2AffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6.3Fixed RHSA-2018:3817
Red Hat JBoss EAP 7.0Fixed RHSA-2017:2810
Red Hat JBoss EAP 7.1Fixed RHSA-2017:3456
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2018:2740
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2018:2742
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2018:2743
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2018:2741
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2017:2809, RHSA-2017:2811
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2017:2808, RHSA-2017:2811
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2017:3454, RHSA-2017:3458
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2017:3455, RHSA-2017:3458
Red Hat JBoss Fuse 6.3Fixed RHSA-2018:3817
Red Hat Satellite 6.4Fixed RHSA-2018:2927
Red Hat Satellite Capsule 6.4Fixed RHSA-2018:2927
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2017:3141
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2017:3141
Not affected: 9 products
  • Red Hat BPM Suite 6
  • Red Hat Fuse 7
  • Red Hat JBoss BRMS 6
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss SOA Platform 5
  • Red Hat Mobile Application Platform 4
  • Red Hat OpenShift Application Runtimes

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7536
  2. 2026-10-03 Alias added: GHSA-xxgp-pcfc-3vgc
  3. 2026-11-05 Fix available: Red Hat JBoss EAP 7.0, Red Hat JBoss EAP 7.1 · Red Hat

References

Advisory 17

Other 5

  • TI-2025-24565 hibernate-validator insecure default Expression Language interpolation CVSS 4.0MEDIUM 6.9
  • TI-2019-07539 Cross-site scripting in hibernate-validator CVSS 3.1MEDIUM 6.1
  • TI-2020-08595 Improper input validation in hibernate-validator CVSS 3.1MEDIUM 5.3
  • TI-2014-02882 ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences