PT-2014-5394 · Hibernate · Hibernate Validator

Published 2014-09-30 · Updated 2022-05-14 · CVE-2014-3558

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hibernate Validator versions 4.1.0 through 4.2.1 Hibernate Validator versions 4.3.x through 4.3.2 Hibernate Validator versions 5.x through 5.1.2

Description The issue allows attackers to bypass Java Security Manager restrictions and execute restricted reflection calls via a crafted application. This is related to the ReflectionHelper class in the org.hibernate.validator.util package.

Recommendations For versions 4.1.0 through 4.2.1, update to version 4.2.1 or later. For versions 4.3.x through 4.3.2, update to version 4.3.2 or later. For versions 5.x through 5.1.2, update to version 5.1.2 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-264

Related Identifiers

CVE-2014-3558

GHSA-845H-985R-JRQH

RHSA-2014:1285

RHSA-2014:1286

RHSA-2014:1287

Affected Products

Hibernate Validator

References · 26

• 🔥 https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3558.yaml · Exploit
• https://security-tracker.debian.org/tracker/CVE-2014-3558 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3558 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3558 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0125.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1286.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3558 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-1285.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1288.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0720.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1287.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3558 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-845h-985r-jrqh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3558 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3558 · Vendor Advisory