logo

Database

Improper authorization control for web services In org.hibernate:hibernate-validator

Description

Improper Authentication in Hibernate Validator ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2014-35582. NVD-2014-35583. OSV-2014-35584. OSV-DEBIAN-2014-35585. GCVE-2014-35586. SECURITY-TRACKER-CVE-2014-3558

References

1. https://github.com/hibernate/hibernate-validator/commit/2c95d4ea0ef20977be249e31a4a4f4f4f71c945d2. https://github.com/hibernate/hibernate-validator/commit/67fdff14831c035c25e098fe14bd86523d17f7263. https://github.com/hibernate/hibernate-validator/commit/7e7131939a4361a7cad3e77ab89a8462132c561c4. https://github.com/hibernate/hibernate-validator/commit/c489416f699a46859c134796b3ccfea41ef3ce525. https://github.com/hibernate/hibernate-validator/commit/c9525ca544b1281e2b7c7347e86e87c86dc1dc6e6. https://github.com/hibernate/hibernate-validator/commit/e8c42b689df8c6752d635d02c6518da3fece38707. https://github.com/hibernate/hibernate-validator/commit/f97c2021a03c825abdeca1692f5be51e77e76a8f8. https://github.com/hibernate/hibernate-validator/commit/fd4eaed7fb930db6a5e4c03742b4b3adcfecc90e9. https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3558.yaml10. https://hibernate.atlassian.net/browse/HV-91211. http://rhn.redhat.com/errata/RHSA-2014-1285.html12. http://rhn.redhat.com/errata/RHSA-2014-1286.html13. http://rhn.redhat.com/errata/RHSA-2014-1287.html14. http://rhn.redhat.com/errata/RHSA-2014-1288.html15. http://rhn.redhat.com/errata/RHSA-2015-0125.html16. http://rhn.redhat.com/errata/RHSA-2015-0720.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.