SQL injection in Hibernate ORM - CVE-2020-25638

Vulnerability identifier: #VU48543

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-25638

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data when "hibernate.use_sql_comments" is configured to true. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Hibernate ORM
Oracle Communications Cloud Native Core Console
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Server
Oracle Utilities Application Framework
Oracle WebLogic Server
Oracle Retail Customer Management and Segmentation Foundation
inter-server-sync-debuginfo
inter-server-sync
saltboot-formula
dhcpd-formula
uyuni-config-formula
prometheus-formula
c3p0
salt-netapi-client
libhibernate3-java (Debian package)
python3-suseRegisterInfo
suseRegisterInfo
spacewalk-reports
python3-mgr-osa-common
python3-mgr-osa-dispatcher
mgr-osa-dispatcher
python3-uyuni-common-libs
spacewalk-setup
mgr-libmod
spacewalk-admin
python3-spacewalk-client-tools
spacewalk-client-tools
susemanager-docs_en
susemanager-docs_en-pdf
susemanager-doc-indexes
spacecmd
spacewalk-utils
spacewalk-utils-extras
python3-spacewalk-certs-tools
spacewalk-certs-tools
susemanager-schema
spacewalk-backend-iss
spacewalk-backend
spacewalk-backend-app
spacewalk-backend-applet
spacewalk-backend-config-files
spacewalk-backend-config-files-common
spacewalk-backend-config-files-tool
spacewalk-backend-sql
spacewalk-backend-iss-export
spacewalk-backend-package-push-server
spacewalk-backend-server
spacewalk-backend-xmlrpc
spacewalk-backend-xml-export-libs
spacewalk-backend-tools
spacewalk-backend-sql-postgresql
spacewalk-base-minimal
susemanager-web-libs
spacewalk-html
spacewalk-base-minimal-config
spacewalk-base
susemanager
susemanager-tools
susemanager-sls
uyuni-config-modules
spacewalk-java-postgresql
spacewalk-java-lib
spacewalk-java-config
spacewalk-java
spacewalk-taskomatic
mgr-push
python3-mgr-push
spacewalk-config
python3-rhnlib
spacewalk-search
spacewalk-branding
hibernate5
py27-compat-salt
JBoss Web Server
CloudLink
IBM Security Verify Governance

Install updates from vendor's website.

Hibernate ORM - addressed in versions 5.3.20, 5.4.24
inter-server-sync-debuginfo - update to 0.0.7-150300.8.9.1
inter-server-sync - update to 0.0.7-150300.8.9.1
saltboot-formula - update to 0.1.1637232240.87d79ed-150300.3.6.1
dhcpd-formula - update to 0.1.1641480250.d5bd14c-150300.3.3.1
uyuni-config-formula - update to 0.2-150300.3.3.1
prometheus-formula - update to 0.3.5-3.15.1
c3p0 - update to 0.9.5.2-150300.4.3.1
salt-netapi-client - update to 0.19.0-150300.3.3.1
libhibernate3-java (Debian package) - update to 3.6.10.Final-9+deb10u1
python3-suseRegisterInfo - addressed in versions 4.1.4-4.6.2, 4.2.5-150300.4.6.1
suseRegisterInfo - addressed in versions 4.1.4-4.6.2, 4.2.5-150300.4.6.1
spacewalk-reports - addressed in versions 4.1.5-3.9.1, 4.2.7-150300.3.9.1
python3-mgr-osa-common - addressed in versions 4.1.6-2.12.2, 4.2.7-150300.2.6.1
python3-mgr-osa-dispatcher - addressed in versions 4.1.6-2.12.2, 4.2.7-150300.2.6.1
mgr-osa-dispatcher - addressed in versions 4.1.6-2.12.2, 4.2.7-150300.2.6.1
python3-uyuni-common-libs - addressed in versions 4.1.10-3.15.1, 4.2.6-150300.3.6.1
spacewalk-setup - addressed in versions 4.1.10-3.15.2, 4.2.10-150300.3.12.1
mgr-libmod - addressed in versions 4.1.10-3.25.2, 4.2.7-150300.3.6.1
spacewalk-admin - update to 4.1.11-3.18.2
python3-spacewalk-client-tools - addressed in versions 4.1.11-4.18.2, 4.2.16-150300.4.15.1
spacewalk-client-tools - addressed in versions 4.1.11-4.18.2, 4.2.16-150300.4.15.1
susemanager-docs_en - addressed in versions 4.1-11.49.1, 4.2-150300.12.19.1
susemanager-docs_en-pdf - addressed in versions 4.1-11.49.1, 4.2-150300.12.19.1
susemanager-doc-indexes - addressed in versions 4.1-11.49.2, 4.2-150300.12.19.1
spacecmd - addressed in versions 4.1.16-4.33.2, 4.2.15-150300.4.15.1
spacewalk-utils - addressed in versions 4.1.19-3.27.2, 4.2.15-150300.3.12.1
spacewalk-utils-extras - addressed in versions 4.1.19-3.27.2, 4.2.15-150300.3.12.1
python3-spacewalk-certs-tools - update to 4.1.20-3.25.2
spacewalk-certs-tools - update to 4.1.20-3.25.2
susemanager-schema - addressed in versions 4.1.24-3.39.2, 4.2.20-150300.3.15.1
spacewalk-backend-iss - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-app - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-applet - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-config-files - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-config-files-common - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-config-files-tool - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-sql - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-iss-export - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-package-push-server - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-server - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-xmlrpc - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-xml-export-libs - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-tools - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-backend-sql-postgresql - addressed in versions 4.1.30-4.47.2, 4.2.19-150300.4.15.1
spacewalk-base-minimal - addressed in versions 4.1.31-3.39.1, 4.2.25-150300.3.15.2
susemanager-web-libs - addressed in versions 4.1.31-3.39.1, 4.2.25-150300.3.15.2
spacewalk-html - addressed in versions 4.1.31-3.39.1, 4.2.25-150300.3.15.2
spacewalk-base-minimal-config - addressed in versions 4.1.31-3.39.1, 4.2.25-150300.3.15.2
spacewalk-base - addressed in versions 4.1.31-3.39.1, 4.2.25-150300.3.15.2
susemanager - addressed in versions 4.1.32-3.42.2, 4.2.27-150300.3.19.1
susemanager-tools - addressed in versions 4.1.32-3.42.2, 4.2.27-150300.3.19.1
susemanager-sls - addressed in versions 4.1.32-3.54.1, 4.2.20-150300.3.17.1
uyuni-config-modules - addressed in versions 4.1.32-3.54.1, 4.2.20-150300.3.17.1
spacewalk-java-postgresql - addressed in versions 4.1.43-3.63.1, 4.2.32-150300.3.20.1
spacewalk-java-lib - addressed in versions 4.1.43-3.63.1, 4.2.32-150300.3.20.1
spacewalk-java-config - addressed in versions 4.1.43-3.63.1, 4.2.32-150300.3.20.1
spacewalk-java - addressed in versions 4.1.43-3.63.1, 4.2.32-150300.3.20.1
spacewalk-taskomatic - addressed in versions 4.1.43-3.63.1, 4.2.32-150300.3.20.1
mgr-push - update to 4.2.4-150300.2.6.1
python3-mgr-push - update to 4.2.4-150300.2.6.1
spacewalk-config - update to 4.2.5-150300.3.3.1
python3-rhnlib - update to 4.2.5-150300.4.6.1
spacewalk-search - update to 4.2.6-150300.3.6.1
spacewalk-branding - update to 4.2.12-150300.3.6.1
hibernate5 - addressed in versions 5.3.7-3.6.1, 5.3.7-150300.5.3.1
JBoss Web Server - update to 5.5.0
CloudLink - update to 8.0-3.10.5.1
IBM Security Verify Governance - update to 10.0.1.0.2
py27-compat-salt - addressed in versions 3000.3-6.18.1, 3000.3-150300.7.7.17.1

• https://jvn.jp/en/jp/JVN90729322/index.html
• https://hibernate.atlassian.net/browse/HHH-14225
• https://access.redhat.com/security/cve/CVE-2020-25638
• https://bugzilla.redhat.com/show_bug.cgi?id=1881353

• SQL injection in Hibernate ORM
• Debian update for libhibernate3-java
• Multiple vulnerabilities in Red Hat JBoss Web Server
• Multiple vulnerabilities in Oracle Retail Customer Management and Segmentation Foundation
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• SUSE update for SUSE Manager Server 4.1
• SUSE update for SUSE Manager Server 4.2
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Dell CloudLink
• SQL injection in Oracle Utilities Application Framework
• Multiple vulnerabilities in IBM Security Verify Governance