CVE catalog
CVE-2019-14900
libhibernate3-java: CVE-2019-14900
- Severity
- Medium · CVSS 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.13% · Oct 25, 2026
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libhibernate3-java | sid | 3.6.10.Final-12 | not affected |
| Debian | libhibernate3-java | forky | 3.6.10.Final-12 | not affected |
| Debian | libhibernate3-java | trixie | 3.6.10.Final-12 | not affected |
| Debian | libhibernate3-java | bookworm | 3.6.10.Final-12 | not affected |
| Suse | spacecmd | manager proxy module 4.0 | 4.0.20-3.19.2 | fixed |
| Suse | spacewalk-certs-tools | manager proxy module 4.0 | 4.0.17-3.21.3 | fixed |
| Suse | spacewalk-proxy | manager proxy module 4.0 | 4.0.14-3.10.3 | fixed |
| Suse | spacewalk-web | manager proxy module 4.0 | 4.0.23-3.30.3 | fixed |
| Suse | hibernate5 | manager server module 4.0 | 5.3.7-4.3.2 | fixed |
| Suse | image-sync-formula | manager server module 4.0 | 0.1.1595937550.0285244-3.20.2 | fixed |
| Suse | openvpn-formula | manager server module 4.0 | 0.1.1-4.6.2 | fixed |
| Suse | prometheus-exporters-formula | manager server module 4.0 | 0.7.1-3.10.2 | fixed |
| Suse | salt-netapi-client | manager server module 4.0 | 0.17.0-4.6.3 | fixed |
| Suse | saltboot-formula | manager server module 4.0 | 0.1.1595937550.0285244-3.19.2 | fixed |
| Suse | spacecmd | manager server module 4.0 | 4.0.20-3.19.2 | fixed |
| Suse | spacewalk-admin | manager server module 4.0 | 4.0.11-3.12.1 | fixed |
| Suse | spacewalk-certs-tools | manager server module 4.0 | 4.0.17-3.21.3 | fixed |
| Suse | spacewalk-java | manager server module 4.0 | 4.0.37-3.39.1 | fixed |
| Suse | spacewalk-setup | manager server module 4.0 | 4.0.14-3.14.1 | fixed |
| Suse | spacewalk-utils | manager server module 4.0 | 4.0.18-3.21.3 | fixed |
| Suse | spacewalk-web | manager server module 4.0 | 4.0.23-3.30.3 | fixed |
| Suse | susemanager | manager server module 4.0 | 4.0.28-3.36.3 | fixed |
| Suse | susemanager-frontend-libs | manager server module 4.0 | 4.0.2-4.3.2 | fixed |
| Suse | susemanager-schema | manager server module 4.0 | 4.0.22-3.29.2 | fixed |
| Suse | susemanager-sls | manager server module 4.0 | 4.0.29-3.31.3 | fixed |
| Suse | susemanager-sync-data | manager server module 4.0 | 4.0.18-3.24.2 | fixed |
| Suse | virtualization-host-formula | manager server module 4.0 | 0.5-4.12.3 | fixed |
| Suse | golang-github-QubitProducts-exporter_exporter | manager server module 4.1 | 0.4.0-6.9.4 | fixed |
| Suse | golang-github-prometheus-node_exporter | manager server module 4.1 | 1.0.1-3.3.4 | fixed |
| Suse | hibernate5 | manager server module 4.1 | 5.3.7-3.3.4 | fixed |
| Suse | hub-xmlrpc-api | manager server module 4.1 | 0.7-3.3.3 | fixed |
| Suse | patterns-suse-manager | manager server module 4.1 | 4.1-6.6.3 | fixed |
| Suse | prometheus-exporters-formula | manager server module 4.1 | 0.7.3-3.10.1 | fixed |
| Suse | salt-netapi-client | manager server module 4.1 | 0.17.0-15.4.3 | fixed |
| Suse | spacecmd | manager server module 4.1 | 4.1.7-4.6.3 | fixed |
| Suse | spacewalk-backend | manager server module 4.1 | 4.1.15-4.8.4 | fixed |
| Suse | spacewalk-branding | manager server module 4.1 | 4.1.10-3.6.3 | fixed |
| Suse | spacewalk-certs-tools | manager server module 4.1 | 4.1.13-3.6.3 | fixed |
| Suse | spacewalk-client-tools | manager server module 4.1 | 4.1.6-4.3.3 | fixed |
| Suse | spacewalk-java | manager server module 4.1 | 4.1.20-3.11.8 | fixed |
| Suse | spacewalk-utils | manager server module 4.1 | 4.1.12-3.6.3 | fixed |
| Suse | spacewalk-web | manager server module 4.1 | 4.1.18-3.6.3 | fixed |
| Suse | subscription-matcher | manager server module 4.1 | 0.26-3.3.3 | fixed |
| Suse | susemanager | manager server module 4.1 | 4.1.20-3.8.3 | fixed |
| Suse | susemanager-build-keys | manager server module 4.1 | 15.2.1-3.3.2 | fixed |
| Suse | susemanager-doc-indexes | manager server module 4.1 | 4.1-11.12.2 | fixed |
| Suse | susemanager-docs_en | manager server module 4.1 | 4.1-11.12.2 | fixed |
| Suse | susemanager-schema | manager server module 4.1 | 4.1.13-3.6.3 | fixed |
| Suse | susemanager-sls | manager server module 4.1 | 4.1.15-3.8.4 | fixed |
| Suse | uyuni-config-formula | manager server module 4.1 | 0.1-6.3.3 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libhibernate3-java | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | libhibernate3-java | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | libhibernate3-java | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | libhibernate3-java | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Suse | spacecmd | rpm | manager proxy module 4.0 | 4.0.20-3.19.2 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | spacewalk-certs-tools | rpm | manager proxy module 4.0 | 4.0.17-3.21.3 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | spacewalk-proxy | rpm | manager proxy module 4.0 | 4.0.14-3.10.3 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | spacewalk-web | rpm | manager proxy module 4.0 | 4.0.23-3.30.3 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | hibernate5 | rpm | manager server module 4.0 | 5.3.7-4.3.2 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | image-sync-formula | rpm | manager server module 4.0 | 0.1.1595937550.0285244-3.20.2 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | openvpn-formula | rpm | manager server module 4.0 | 0.1.1-4.6.2 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | prometheus-exporters-formula | rpm | manager server module 4.0 | 0.7.1-3.10.2 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | salt-netapi-client | rpm | manager server module 4.0 | 0.17.0-4.6.3 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | saltboot-formula | rpm | manager server module 4.0 | 0.1.1595937550.0285244-3.19.2 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | spacecmd | rpm | manager server module 4.0 | 4.0.20-3.19.2 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | spacewalk-admin | rpm | manager server module 4.0 | 4.0.11-3.12.1 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | spacewalk-certs-tools | rpm | manager server module 4.0 | 4.0.17-3.21.3 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | spacewalk-java | rpm | manager server module 4.0 | 4.0.37-3.39.1 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | spacewalk-setup | rpm | manager server module 4.0 | 4.0.14-3.14.1 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | spacewalk-utils | rpm | manager server module 4.0 | 4.0.18-3.21.3 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | spacewalk-web | rpm | manager server module 4.0 | 4.0.23-3.30.3 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | susemanager | rpm | manager server module 4.0 | 4.0.28-3.36.3 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | susemanager-frontend-libs | rpm | manager server module 4.0 | 4.0.2-4.3.2 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | susemanager-schema | rpm | manager server module 4.0 | 4.0.22-3.29.2 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | susemanager-sls | rpm | manager server module 4.0 | 4.0.29-3.31.3 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | susemanager-sync-data | rpm | manager server module 4.0 | 4.0.18-3.24.2 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | virtualization-host-formula | rpm | manager server module 4.0 | 0.5-4.12.3 | Not reported | SUSE-SU-2020:2650-1 | Not reported |
| Suse | golang-github-QubitProducts-exporter_exporter | rpm | manager server module 4.1 | 0.4.0-6.9.4 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | golang-github-prometheus-node_exporter | rpm | manager server module 4.1 | 1.0.1-3.3.4 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | hibernate5 | rpm | manager server module 4.1 | 5.3.7-3.3.4 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | hub-xmlrpc-api | rpm | manager server module 4.1 | 0.7-3.3.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | patterns-suse-manager | rpm | manager server module 4.1 | 4.1-6.6.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | prometheus-exporters-formula | rpm | manager server module 4.1 | 0.7.3-3.10.1 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | salt-netapi-client | rpm | manager server module 4.1 | 0.17.0-15.4.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | spacecmd | rpm | manager server module 4.1 | 4.1.7-4.6.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | spacewalk-backend | rpm | manager server module 4.1 | 4.1.15-4.8.4 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | spacewalk-branding | rpm | manager server module 4.1 | 4.1.10-3.6.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | spacewalk-certs-tools | rpm | manager server module 4.1 | 4.1.13-3.6.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | spacewalk-client-tools | rpm | manager server module 4.1 | 4.1.6-4.3.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | spacewalk-java | rpm | manager server module 4.1 | 4.1.20-3.11.8 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | spacewalk-utils | rpm | manager server module 4.1 | 4.1.12-3.6.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | spacewalk-web | rpm | manager server module 4.1 | 4.1.18-3.6.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | subscription-matcher | rpm | manager server module 4.1 | 0.26-3.3.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | susemanager | rpm | manager server module 4.1 | 4.1.20-3.8.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | susemanager-build-keys | rpm | manager server module 4.1 | 15.2.1-3.3.2 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | susemanager-doc-indexes | rpm | manager server module 4.1 | 4.1-11.12.2 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | susemanager-docs_en | rpm | manager server module 4.1 | 4.1-11.12.2 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | susemanager-schema | rpm | manager server module 4.1 | 4.1.13-3.6.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | susemanager-sls | rpm | manager server module 4.1 | 4.1.15-3.8.4 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
| Suse | uyuni-config-formula | rpm | manager server module 4.1 | 0.1-6.3.3 | Not reported | SUSE-SU-2020:2832-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libhibernate3-java]Not affected
Details (2)
3.6.10.Final-12· all · bookwormNot affected
dsa · libhibernate3-java · debian · bookworm
3.6.10.Final-12· all · bookwormNot affected
dsa · libhibernate3-java · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_2650-1.json]
- [https://osv.dev/vulnerability/SUSE-SU-2020:2650-1]
- [https://osv.dev/vulnerability/SUSE-SU-2020:2832-1]
- [https://security-tracker.debian.org/tracker/CVE-2019-14900]
- [https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-14900.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2022-1912.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]