PT-2016-7022 · Pivotal · Spring Data Jpa

Antti Ahola + 5 · Published 2016-10-05 · Updated 2022-05-17 · CVE-2016-6652

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pivotal Spring Data JPA versions prior to 1.9.6 (Gosling SR6) Pivotal Spring Data JPA versions 1.10.x prior to 1.10.4 (Hopper SR4)

Description The issue allows attackers to execute arbitrary JPQL commands via a sort instance with a function call, when used with a repository that defines a String query using the @Query annotation.

Recommendations For Pivotal Spring Data JPA versions prior to 1.9.6 (Gosling SR6), update to version 1.9.6 or later. For Pivotal Spring Data JPA versions 1.10.x prior to 1.10.4 (Hopper SR4), update to version 1.10.4 or later. As a temporary workaround, consider restricting the use of the @Query annotation in repositories that define String queries.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-6652

GHSA-XR4V-28RM-PVGW

Affected Products

Spring Data Jpa

References · 9

• https://github.com/spring-projects/spring-data-jpa/commit/b8e7fe · Patch
• https://osv.dev/vulnerability/CVE-2016-6652 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xr4v-28rm-pvgw · Vendor Advisory
• https://security.gentoo.org/glsa/201701-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6652 · Security Note
• https://pivotal.io/security/cve-2016-6652 · Vendor Advisory
• https://jira.spring.io/browse/DATAJPA-965 · Vendor Advisory
• http://securityfocus.com/bid/93276 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6652 · Note