Read the docs
TI-2019-11104 Aliases CVE-2019-14900GHSA-8grg-q944-cch5

SQL injection in Hibernate

Priority LOW 33CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 13 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.

Summary

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.

Why it matters now

EPSS 0.02126 82nd percentileScored 2026-11-07
Fix Partial org.hibernate:hibernate-core (Maven): 5.3.18, 5.4.18, 5.5.0.Beta1Red Hat: 14 advisoriesRed Hat: 13 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—HibernateVersions before Hibernate ORM 5.3.18; Versions before Hibernate ORM 5.4.18; Versions before Hibernate ORM 5.5.0.Beta1—No fix listedCNA
—org.hibernate:hibernate-core (Maven)before 5.3.185.3.18Patch availableGHSA-8grg-q944-cch5
—org.hibernate:hibernate-core (Maven)5.4.0 to before 5.4.185.4.18Patch availableGHSA-8grg-q944-cch5
—org.hibernate:hibernate-core (Maven)5.5.0.Alpha1 to before 5.5.0.Beta15.5.0.Beta1Patch availableGHSA-8grg-q944-cch5
  • Hibernate Vendor— Affected Versions before Hibernate ORM 5.3.18; Versions before Hibernate ORM 5.4.18; Versions before Hibernate ORM 5.5.0.Beta1 Fixed in — No fix listed CNA
  • org.hibernate:hibernate-core (Maven) Vendor— Affected before 5.3.18 Fixed in 5.3.18 Patch available GHSA-8grg-q944-cch5
  • org.hibernate:hibernate-core (Maven) Vendor— Affected 5.4.0 to before 5.4.18 Fixed in 5.4.18 Patch available GHSA-8grg-q944-cch5
  • org.hibernate:hibernate-core (Maven) Vendor— Affected 5.5.0.Alpha1 to before 5.5.0.Beta1 Fixed in 5.5.0.Beta1 Patch available GHSA-8grg-q944-cch5

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:hibernate:hibernate_orm:*:*:*:*:*:*:*:*before 5.3.18; 5.4.0 to before 5.4.18VulnerableHibernate
cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:fuse:*:*:*:*:*:*:*:*before 7.8.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*10VulnerableRed Hat
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*13VulnerableRed Hat
cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*14VulnerableRed Hat
  • cpe:2.3:a:hibernate:hibernate_orm:*:*:*:*:*:*:*:* Versions before 5.3.18; 5.4.0 to before 5.4.18 Vulnerable ·Hibernate
  • cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:fuse:*:*:*:*:*:*:*:* Versions before 7.8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* Versions 14 Vulnerable ·Red Hat
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*up to 1.5.2Vulnerablequarkusio
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
  • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 1.5.2 Vulnerable ·quarkusio
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-8grg-q944-cch5 org.hibernate:hibernate-core (Maven) Fixed in 5.3.18 Advisory →
  • Fix · GHSA-8grg-q944-cch5 org.hibernate:hibernate-core (Maven) Fixed in 5.4.18 Advisory →
  • Fix · GHSA-8grg-q944-cch5 org.hibernate:hibernate-core (Maven) Fixed in 5.5.0.Beta1 Advisory →

Red Hat 14 advisories

  • RHSA-2020:5568 Released 2020-12-16 · Red Hat rating Important
    Red Hat Fuse 7.8.0 release and security update
    • Red Hat Fuse 7.8.0
  • RHSA-2020:4961 Released 2020-11-05 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.9.0 security update
    • RHPAM 7.9.0
  • RHSA-2020:4960 Released 2020-11-05 · Red Hat rating Moderate
    Red Hat Decision Manager 7.9.0 security update
    • RHDM 7.9.0
Show 11 more Red Hat advisories
  • RHSA-2020:4252 Released 2020-10-14 · Red Hat rating Important
    Red Hat build of Quarkus 1.7.5 release and security update
    • Red Hat build of Quarkus 1.7.5
  • RHSA-2020:3642 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:3638 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el7eap +47
  • RHSA-2020:3639 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el8eap +47
  • RHSA-2020:3637 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el6eap +47
  • RHSA-2020:3585 Released 2020-08-31 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 20 security update
    • EAP-CD 20 Tech Preview
  • RHSA-2020:3463 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el8eap +47
  • RHSA-2020:3462 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el7eap +47
  • RHSA-2020:3461 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el6eap +47
  • RHSA-2020:3464 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:2112 Released 2020-05-12 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.8 security update
    • Red Hat Single Sign On 7.3.8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Decision Manager 7AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix yet
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix yet
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
EAP-CD 20 Tech PreviewFixed RHSA-2020:3585
RHDM 7.9.0Fixed RHSA-2020:4960
RHPAM 7.9.0Fixed RHSA-2020:4961
Red Hat Fuse 7.8.0Fixed RHSA-2020:5568
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:3637
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:3638
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:3639
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:3463
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:3461
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:3462
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:3464
Red Hat Single Sign On 7.3.8Fixed RHSA-2020:2112
Red Hat build of Quarkus 1.7.5Fixed RHSA-2020:4252
Not affected: 10 products
  • Red Hat JBoss BRMS 5
  • Red Hat JBoss Enterprise Application Platform 5
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Web Server 2
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Operations Network 3
  • Red Hat Satellite 5
  • Red Hat Satellite 6
  • Red Hat Subscription Asset Manager

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14900
  2. 2026-10-03 Alias added: GHSA-8grg-q944-cch5

References

Advisory 3

Other 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences