Read the docs
TI-2020-15656 Aliases CVE-2020-25638GHSA-j8jw-g6fq-mp7h

SQL injection in hibernate-core

Priority MEDIUM 40CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 18 fixed, 16 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.

Summary

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02929 87th percentileScored 2026-11-07
Fix Partial org.hibernate:hibernate-core (Maven): 5.4.24.Final, 5.3.20.FinalRed Hat: 19 advisoriesRed Hat: 18 fixed, 16 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—hibernate-coreHibernate ORM versions before 5.4.24.Final—No fix listedCNA
—org.hibernate:hibernate-core (Maven)5.4.0.Final to before 5.4.24.Final5.4.24.FinalPatch availableGHSA-j8jw-g6fq-mp7h
—org.hibernate:hibernate-core (Maven)before 5.3.20.Final5.3.20.FinalPatch availableGHSA-j8jw-g6fq-mp7h
  • hibernate-core Vendor— Affected Hibernate ORM versions before 5.4.24.Final Fixed in — No fix listed CNA
  • org.hibernate:hibernate-core (Maven) Vendor— Affected 5.4.0.Final to before 5.4.24.Final Fixed in 5.4.24.Final Patch available GHSA-j8jw-g6fq-mp7h
  • org.hibernate:hibernate-core (Maven) Vendor— Affected before 5.3.20.Final Fixed in 5.3.20.Final Patch available GHSA-j8jw-g6fq-mp7h

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:hibernate:hibernate_orm:*:*:*:*:*:*:*:*before 5.3.20; 5.4.0 to before 5.4.24VulnerableHibernate
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*up to 1.9.2Vulnerablequarkusio
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*19.0VulnerableOracle
  • cpe:2.3:a:hibernate:hibernate_orm:*:*:*:*:*:*:*:* Versions before 5.3.20; 5.4.0 to before 5.4.24 Vulnerable ·Hibernate
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 1.9.2 Vulnerable ·quarkusio
  • cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-j8jw-g6fq-mp7h org.hibernate:hibernate-core (Maven) Fixed in 5.4.24.Final Advisory →
  • Fix · GHSA-j8jw-g6fq-mp7h org.hibernate:hibernate-core (Maven) Fixed in 5.3.20.Final Advisory →

Red Hat 19 advisories

  • RHSA-2025:9582 Released 2025-06-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-glassfish-el-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-glassfish-el-impl-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate-5.1.17-3.Final_redhat_00004.1.ep7.el7 +22
  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2021:2561 Released 2021-06-29 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.5.0 Security release
    • Red Hat JBoss Web Server 5.5 for RHEL 7 Server jws5-ecj-4.12.0-3.redhat_2.2.el7jws, jws5-mod_cluster-1.4.3-2.Final_redhat_00002.1.el7jws, jws5-mod_cluster-tomcat-1.4.3-2.Final_redhat_00002.1.el7jws +15
    • Red Hat JBoss Web Server 5.5 for RHEL 8 jws5-ecj-4.12.0-3.redhat_2.2.el8jws, jws5-mod_cluster-1.4.3-2.Final_redhat_00002.1.el8jws, jws5-mod_cluster-tomcat-1.4.3-2.Final_redhat_00002.1.el8jws +13
Show 16 more Red Hat advisories
  • RHSA-2021:2562 Released 2021-06-29 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.5.0 security release
    • Red Hat JBoss Web Server 5
  • RHSA-2021:2039 Released 2021-05-19 · Red Hat rating Moderate
    Service Registry (container images) release and security update [1.1.1.GA]
    • Red Hat Integration
  • RHSA-2021:0603 Released 2021-02-17 · Red Hat rating Important
    Red Hat Decision Manager 7.10.0 security update
    • RHDM 7.10.0
  • RHSA-2021:0600 Released 2021-02-17 · Red Hat rating Important
    Red Hat Process Automation Manager 7.10.0 security update
    • RHPAM 7.10.0
  • RHSA-2021:0292 Released 2021-02-02 · Red Hat rating Important
    Red Hat support for Spring Boot 2.3.6 security update
    • Red Hat support for Spring Boot 2.3.6
  • RHSA-2020:5388 Released 2021-01-07 · Red Hat rating Important
    Red Hat support for Spring Boot 2.2.11 security update
    • Text-Only RHOAR
  • RHSA-2020:5361 Released 2020-12-16 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.2 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:5533 Released 2020-12-15 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.4 security update
    • Red Hat Single Sign-On 7
  • RHSA-2020:5342 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-6.redhat_00016.1.el8eap, eap7-activemq-artemis-cli-2.9.0-6.redhat_00016.1.el8eap, eap7-activemq-artemis-commons-2.9.0-6.redhat_00016.1.el8eap +47
  • RHSA-2020:5341 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-6.redhat_00016.1.el7eap, eap7-activemq-artemis-cli-2.9.0-6.redhat_00016.1.el7eap, eap7-activemq-artemis-commons-2.9.0-6.redhat_00016.1.el7eap +47
  • RHSA-2020:5340 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-6.redhat_00016.1.el6eap, eap7-activemq-artemis-cli-2.9.0-6.redhat_00016.1.el6eap, eap7-activemq-artemis-commons-2.9.0-6.redhat_00016.1.el6eap +47
  • RHSA-2020:5344 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:5302 Released 2020-12-01 · Red Hat rating Important
    Red Hat build of Quarkus 1.7.5 SP1 release and security update
    • Red Hat build of Quarkus 1.7.5 SP1
  • RHSA-2020:5254 Released 2020-11-30 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.3 one-off security update
    • Red Hat Single Sign-On 7.4.3 one-off
  • RHSA-2020:5175 Released 2020-11-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-hibernate-5.3.18-2.Final_redhat_00002.1.el8eap, eap7-hibernate-core-5.3.18-2.Final_redhat_00002.1.el8eap, eap7-hibernate-entitymanager-5.3.18-2.Final_redhat_00002.1.el8eap +2
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-hibernate-5.3.18-2.Final_redhat_00002.1.el6eap, eap7-hibernate-core-5.3.18-2.Final_redhat_00002.1.el6eap, eap7-hibernate-entitymanager-5.3.18-2.Final_redhat_00002.1.el6eap +2
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-hibernate-5.3.18-2.Final_redhat_00002.1.el7eap, eap7-hibernate-core-5.3.18-2.Final_redhat_00002.1.el7eap, eap7-hibernate-entitymanager-5.3.18-2.Final_redhat_00002.1.el7eap +2
  • RHSA-2020:5174 Released 2020-11-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.3 security update
    • EAP 7.3.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Decision Manager 7AffectedNo fix planned: Will not fix
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat support for Spring BootAffectedNo fix yet
EAP 7.3.3Fixed RHSA-2020:5174
RHDM 7.10.0Fixed RHSA-2021:0603
RHPAM 7.10.0Fixed RHSA-2021:0600
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat IntegrationFixed RHSA-2021:2039
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:5175, RHSA-2020:5342
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:5175, RHSA-2020:5340
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:5175, RHSA-2020:5341
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:5344
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:9582
Red Hat JBoss Web Server 5Fixed RHSA-2021:2562
Red Hat JBoss Web Server 5.5 for RHEL 7 ServerFixed RHSA-2021:2561
Red Hat JBoss Web Server 5.5 for RHEL 8Fixed RHSA-2021:2561
Red Hat Single Sign-On 7Fixed RHSA-2020:5533
Red Hat Single Sign-On 7.4.3 one-offFixed RHSA-2020:5254
Red Hat build of Quarkus 1.7.5 SP1Fixed RHSA-2020:5302
Red Hat support for Spring Boot 2.3.6Fixed RHSA-2021:0292
Text-Only RHOARFixed RHSA-2020:5361
Not affected: 2 products
  • A-MQ Clients 2
  • Red Hat Integration Camel K 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25638
  2. 2026-10-03 Alias added: GHSA-j8jw-g6fq-mp7h
  3. 2026-11-04 Fix available: Red Hat Single Sign-On 7 · Red Hat

References

Patch 3

Advisory 4

Other 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences