PT-2014-5394 · Hibernate · Hibernate Validator

Publicado 2014-09-30 · Atualizado 2022-05-14 · CVE-2014-3558

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hibernate Validator versions 4.1.0 through 4.2.1 Hibernate Validator versions 4.3.x through 4.3.2 Hibernate Validator versions 5.x through 5.1.2

Description The issue allows attackers to bypass Java Security Manager restrictions and execute restricted reflection calls via a crafted application. This is related to the ReflectionHelper class in the org.hibernate.validator.util package.

Recommendations For versions 4.1.0 through 4.2.1, update to version 4.2.1 or later. For versions 4.3.x through 4.3.2, update to version 4.3.2 or later. For versions 5.x through 5.1.2, update to version 5.1.2 or later.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

CWE-264

Identificadores relacionados

CVE-2014-3558

GHSA-845H-985R-JRQH

RHSA-2014:1285

RHSA-2014:1286

RHSA-2014:1287

Produtos afetados

Hibernate Validator

Referências · 26

• 🔥 https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3558.yaml · Exploit
• https://github.com/hibernate/hibernate-validator · Nota
• https://github.com/hibernate/hibernate-validator/commit/f97c2021a03c825abdeca1692f5be51e77e76a8f · Nota
• https://github.com/hibernate/hibernate-validator/commit/e8c42b689df8c6752d635d02c6518da3fece3870 · Nota
• https://github.com/hibernate/hibernate-validator/commit/c9525ca544b1281e2b7c7347e86e87c86dc1dc6e · Nota
• https://github.com/hibernate/hibernate-validator/commit/c489416f699a46859c134796b3ccfea41ef3ce52 · Nota
• https://github.com/hibernate/hibernate-validator/commit/2c95d4ea0ef20977be249e31a4a4f4f4f71c945d · Nota
• https://github.com/hibernate/hibernate-validator/commit/67fdff14831c035c25e098fe14bd86523d17f726 · Nota
• https://github.com/hibernate/hibernate-validator/commit/fd4eaed7fb930db6a5e4c03742b4b3adcfecc90e · Nota
• https://github.com/hibernate/hibernate-validator/commit/7e7131939a4361a7cad3e77ab89a8462132c561c · Nota
• https://security-tracker.debian.org/tracker/CVE-2014-3558 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-3558 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-3558 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2015-0125.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-1286.html · Aviso do Fabricante