Vulnerabilities in hibernate-core

[MaximMoinat]

We found a number of vulnerabilities (identified by Snyk) in the WebApi. Most of which can be fixed easily by updating the dependencies.

Issue

SQL Injection. Introduced through: org.hibernate:hibernate-core@5.4.2.Final, org.hibernate:hibernate-entitymanager@5.4.2.Final and others

A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

Remediations

• Upgrade to org.hibernate:hibernate-core@5.4.24.Final
• Upgrade to org.hibernate:hibernate-entitymanager@5.4.24.Final
• Reinstall the dependencies. If the problem persists, one of your dependencies may be bundling outdated modules.

[ssuvorov-fls]

Eager loading is ignored in 5.4.24 org.hibernate:hibernate-core@5.4.24.Final so it was reverted to org.hibernate:hibernate-core@5.4.21.Final
Bug with absent eager loading - #1758

[chrisknoll]

Do you know if this works in 5.4.27?

[ssuvorov-fls]

@chrisknoll
No, it doesn't, the last working version is 5.4.21

[chrisknoll]

That's odd, i was hoping this was the issue that was in hibernate core: hibernate/hibernate-reactive#453

[ssuvorov-fls]

Yes, it's very strange changes. After 5.4.21 hibernate does not generate sql for collections with eager fetching before such collections are used