CVE catalog
CVE-2020-25638
libhibernate3-java: CVE-2020-25638
- Severity
- High · CVSS 7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.93% · Oct 25, 2026
A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libhibernate3-java | sid | 3.6.10.Final-12 | fixed |
| Debian | libhibernate3-java | forky | 3.6.10.Final-12 | fixed |
| Debian | libhibernate3-java | trixie | 3.6.10.Final-12 | fixed |
| Debian | libhibernate3-java | bookworm | 3.6.10.Final-12 | fixed |
| Ubuntu | libhibernate3-java | pro | 3.6.10.Final-7 | vulnerable |
| Ubuntu | libhibernate3-java | pro | 3.6.10.Final-8 | vulnerable |
| Ubuntu | libhibernate3-java | pro | 3.6.10.Final-9 | vulnerable |
| Ubuntu | libhibernate3-java | pro | 3.6.10.Final-9ubuntu0.18.04.1~esm1 | fixed |
| Ubuntu | libhibernate3-java | 20.04 | 3.6.10.Final-9 | vulnerable |
| Ubuntu | libhibernate3-java | 20.04 | 3.6.10.Final-9+deb10u1build0.20.04.1 | fixed |
| Suse | c3p0 | manager server module 4.2 | 0.9.5.2-150300.4.3.1 | fixed |
| Suse | dhcpd-formula | manager server module 4.2 | 0.1.1641480250.d5bd14c-150300.3.3.1 | fixed |
| Suse | hibernate5 | manager server module 4.2 | 5.3.7-150300.5.3.1 | fixed |
| Suse | inter-server-sync | manager server module 4.2 | 0.0.7-150300.8.9.1 | fixed |
| Suse | mgr-libmod | manager server module 4.2 | 4.2.7-150300.3.6.1 | fixed |
| Suse | mgr-osad | manager server module 4.2 | 4.2.7-150300.2.6.1 | fixed |
| Suse | mgr-push | manager server module 4.2 | 4.2.4-150300.2.6.1 | fixed |
| Suse | py27-compat-salt | manager server module 4.2 | 3000.3-150300.7.7.17.1 | fixed |
| Suse | rhnlib | manager server module 4.2 | 4.2.5-150300.4.6.1 | fixed |
| Suse | salt-netapi-client | manager server module 4.2 | 0.19.0-150300.3.3.1 | fixed |
| Suse | saltboot-formula | manager server module 4.2 | 0.1.1637232240.87d79ed-150300.3.6.1 | fixed |
| Suse | spacecmd | manager server module 4.2 | 4.2.15-150300.4.15.1 | fixed |
| Suse | spacewalk-backend | manager server module 4.2 | 4.2.19-150300.4.15.1 | fixed |
| Suse | spacewalk-branding | manager server module 4.2 | 4.2.12-150300.3.6.1 | fixed |
| Suse | spacewalk-client-tools | manager server module 4.2 | 4.2.16-150300.4.15.1 | fixed |
| Suse | spacewalk-config | manager server module 4.2 | 4.2.5-150300.3.3.1 | fixed |
| Suse | spacewalk-java | manager server module 4.2 | 4.2.32-150300.3.20.1 | fixed |
| Suse | spacewalk-reports | manager server module 4.2 | 4.2.7-150300.3.9.1 | fixed |
| Suse | spacewalk-search | manager server module 4.2 | 4.2.6-150300.3.6.1 | fixed |
| Suse | spacewalk-setup | manager server module 4.2 | 4.2.10-150300.3.12.1 | fixed |
| Suse | spacewalk-utils | manager server module 4.2 | 4.2.15-150300.3.12.1 | fixed |
| Suse | spacewalk-web | manager server module 4.2 | 4.2.25-150300.3.15.2 | fixed |
| Suse | suseRegisterInfo | manager server module 4.2 | 4.2.5-150300.4.6.1 | fixed |
| Suse | susemanager | manager server module 4.2 | 4.2.27-150300.3.19.1 | fixed |
| Suse | susemanager-doc-indexes | manager server module 4.2 | 4.2-150300.12.19.1 | fixed |
| Suse | susemanager-docs_en | manager server module 4.2 | 4.2-150300.12.19.1 | fixed |
| Suse | susemanager-schema | manager server module 4.2 | 4.2.20-150300.3.15.1 | fixed |
| Suse | susemanager-sls | manager server module 4.2 | 4.2.20-150300.3.17.1 | fixed |
| Suse | uyuni-common-libs | manager server module 4.2 | 4.2.6-150300.3.6.1 | fixed |
| Suse | uyuni-config-formula | manager server module 4.2 | 0.2-150300.3.3.1 | fixed |
| Ubuntu | libhibernate3-java | pro | 3.6.10.Final-7 | vulnerable |
| Ubuntu | libhibernate3-java | pro | 3.6.10.Final-8 | vulnerable |
| Ubuntu | libhibernate3-java | pro | 3.6.10.Final-9 | vulnerable |
| Ubuntu | libhibernate3-java | pro | 3.6.10.Final-9ubuntu0.18.04.1~esm1 | fixed |
| Ubuntu | libhibernate3-java | 20.04 | 3.6.10.Final-9 | vulnerable |
| Ubuntu | libhibernate3-java | 20.04 | 3.6.10.Final-9+deb10u1build0.20.04.1 | fixed |
| Suse | hibernate5 | manager server module 4.1 | 5.3.7-3.6.1 | fixed |
| Suse | mgr-libmod | manager server module 4.1 | 4.1.10-3.25.2 | fixed |
| Suse | mgr-osad | manager server module 4.1 | 4.1.6-2.12.2 | fixed |
| Suse | prometheus-formula | manager server module 4.1 | 0.3.5-3.15.1 | fixed |
| Suse | py27-compat-salt | manager server module 4.1 | 3000.3-6.18.1 | fixed |
| Suse | spacecmd | manager server module 4.1 | 4.1.16-4.33.2 | fixed |
| Suse | spacewalk-admin | manager server module 4.1 | 4.1.11-3.18.2 | fixed |
| Suse | spacewalk-backend | manager server module 4.1 | 4.1.30-4.47.2 | fixed |
| Suse | spacewalk-certs-tools | manager server module 4.1 | 4.1.20-3.25.2 | fixed |
| Suse | spacewalk-client-tools | manager server module 4.1 | 4.1.11-4.18.2 | fixed |
| Suse | spacewalk-java | manager server module 4.1 | 4.1.43-3.63.1 | fixed |
| Suse | spacewalk-reports | manager server module 4.1 | 4.1.5-3.9.1 | fixed |
| Suse | spacewalk-setup | manager server module 4.1 | 4.1.10-3.15.2 | fixed |
| Suse | spacewalk-utils | manager server module 4.1 | 4.1.19-3.27.2 | fixed |
| Suse | spacewalk-web | manager server module 4.1 | 4.1.31-3.39.1 | fixed |
| Suse | suseRegisterInfo | manager server module 4.1 | 4.1.4-4.6.2 | fixed |
| Suse | susemanager | manager server module 4.1 | 4.1.32-3.42.2 | fixed |
| Suse | susemanager-doc-indexes | manager server module 4.1 | 4.1-11.49.2 | fixed |
| Suse | susemanager-docs_en | manager server module 4.1 | 4.1-11.49.1 | fixed |
| Suse | susemanager-schema | manager server module 4.1 | 4.1.24-3.39.2 | fixed |
| Suse | susemanager-sls | manager server module 4.1 | 4.1.32-3.54.1 | fixed |
| Suse | uyuni-common-libs | manager server module 4.1 | 4.1.10-3.15.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libhibernate3-java | source | sid | 3.6.10.Final-11 | not yet assigned | Not reported | Not reported |
| Debian | libhibernate3-java | source | forky | 3.6.10.Final-11 | not yet assigned | Not reported | Not reported |
| Debian | libhibernate3-java | source | trixie | 3.6.10.Final-11 | not yet assigned | Not reported | Not reported |
| Debian | libhibernate3-java | source | bookworm | 3.6.10.Final-11 | not yet assigned | Not reported | Not reported |
| Ubuntu | libhibernate3-java | deb | pro | 3.6.10.Final-9ubuntu0.18.04.1~esm1 | Not reported | USN-6845-1 | Not reported |
| Ubuntu | libhibernate3-java | deb | 20.04 | 3.6.10.Final-9+deb10u1build0.20.04.1 | Not reported | USN-6845-1 | Not reported |
| Suse | c3p0 | rpm | manager server module 4.2 | 0.9.5.2-150300.4.3.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | dhcpd-formula | rpm | manager server module 4.2 | 0.1.1641480250.d5bd14c-150300.3.3.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | hibernate5 | rpm | manager server module 4.2 | 5.3.7-150300.5.3.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | inter-server-sync | rpm | manager server module 4.2 | 0.0.7-150300.8.9.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | mgr-libmod | rpm | manager server module 4.2 | 4.2.7-150300.3.6.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | mgr-osad | rpm | manager server module 4.2 | 4.2.7-150300.2.6.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | mgr-push | rpm | manager server module 4.2 | 4.2.4-150300.2.6.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | py27-compat-salt | rpm | manager server module 4.2 | 3000.3-150300.7.7.17.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | rhnlib | rpm | manager server module 4.2 | 4.2.5-150300.4.6.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | salt-netapi-client | rpm | manager server module 4.2 | 0.19.0-150300.3.3.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | saltboot-formula | rpm | manager server module 4.2 | 0.1.1637232240.87d79ed-150300.3.6.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | spacecmd | rpm | manager server module 4.2 | 4.2.15-150300.4.15.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | spacewalk-backend | rpm | manager server module 4.2 | 4.2.19-150300.4.15.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | spacewalk-branding | rpm | manager server module 4.2 | 4.2.12-150300.3.6.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | spacewalk-client-tools | rpm | manager server module 4.2 | 4.2.16-150300.4.15.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | spacewalk-config | rpm | manager server module 4.2 | 4.2.5-150300.3.3.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | spacewalk-java | rpm | manager server module 4.2 | 4.2.32-150300.3.20.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | spacewalk-reports | rpm | manager server module 4.2 | 4.2.7-150300.3.9.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | spacewalk-search | rpm | manager server module 4.2 | 4.2.6-150300.3.6.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | spacewalk-setup | rpm | manager server module 4.2 | 4.2.10-150300.3.12.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | spacewalk-utils | rpm | manager server module 4.2 | 4.2.15-150300.3.12.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | spacewalk-web | rpm | manager server module 4.2 | 4.2.25-150300.3.15.2 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | suseRegisterInfo | rpm | manager server module 4.2 | 4.2.5-150300.4.6.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | susemanager | rpm | manager server module 4.2 | 4.2.27-150300.3.19.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | susemanager-doc-indexes | rpm | manager server module 4.2 | 4.2-150300.12.19.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | susemanager-docs_en | rpm | manager server module 4.2 | 4.2-150300.12.19.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | susemanager-schema | rpm | manager server module 4.2 | 4.2.20-150300.3.15.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | susemanager-sls | rpm | manager server module 4.2 | 4.2.20-150300.3.17.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | uyuni-common-libs | rpm | manager server module 4.2 | 4.2.6-150300.3.6.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Suse | uyuni-config-formula | rpm | manager server module 4.2 | 0.2-150300.3.3.1 | Not reported | SUSE-SU-2022:0593-1 | Not reported |
| Ubuntu | libhibernate3-java | deb | pro | 3.6.10.Final-9ubuntu0.18.04.1~esm1 | Not reported | UBUNTU-CVE-2020-25638 | Not reported |
| Ubuntu | libhibernate3-java | deb | 20.04 | 3.6.10.Final-9+deb10u1build0.20.04.1 | Not reported | UBUNTU-CVE-2020-25638 | Not reported |
| Suse | hibernate5 | rpm | manager server module 4.1 | 5.3.7-3.6.1 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | mgr-libmod | rpm | manager server module 4.1 | 4.1.10-3.25.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | mgr-osad | rpm | manager server module 4.1 | 4.1.6-2.12.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | prometheus-formula | rpm | manager server module 4.1 | 0.3.5-3.15.1 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | py27-compat-salt | rpm | manager server module 4.1 | 3000.3-6.18.1 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | spacecmd | rpm | manager server module 4.1 | 4.1.16-4.33.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | spacewalk-admin | rpm | manager server module 4.1 | 4.1.11-3.18.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | spacewalk-backend | rpm | manager server module 4.1 | 4.1.30-4.47.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | spacewalk-certs-tools | rpm | manager server module 4.1 | 4.1.20-3.25.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | spacewalk-client-tools | rpm | manager server module 4.1 | 4.1.11-4.18.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | spacewalk-java | rpm | manager server module 4.1 | 4.1.43-3.63.1 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | spacewalk-reports | rpm | manager server module 4.1 | 4.1.5-3.9.1 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | spacewalk-setup | rpm | manager server module 4.1 | 4.1.10-3.15.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | spacewalk-utils | rpm | manager server module 4.1 | 4.1.19-3.27.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | spacewalk-web | rpm | manager server module 4.1 | 4.1.31-3.39.1 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | suseRegisterInfo | rpm | manager server module 4.1 | 4.1.4-4.6.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | susemanager | rpm | manager server module 4.1 | 4.1.32-3.42.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | susemanager-doc-indexes | rpm | manager server module 4.1 | 4.1-11.49.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | susemanager-docs_en | rpm | manager server module 4.1 | 4.1-11.49.1 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | susemanager-schema | rpm | manager server module 4.1 | 4.1.24-3.39.2 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | susemanager-sls | rpm | manager server module 4.1 | 4.1.32-3.54.1 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
| Suse | uyuni-common-libs | rpm | manager server module 4.1 | 4.1.10-3.15.1 | Not reported | SUSE-SU-2022:0225-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libhibernate3-java]Fixed
Details (2)
3.6.10.Final-12· all · bookwormFixed · Fixed:
3.6.10.Final-11dsa · libhibernate3-java · debian · bookworm; dsa · libhibernate3-java · debian · 12
3.6.10.Final-12· all · bookwormFixed · Fixed:
3.6.10.Final-11dsa · libhibernate3-java · debian · bookworm; dsa · libhibernate3-java · debian · 12
[Debian 13 (Trixie)]
- [libhibernate3-java]Fixed
Details (2)
3.6.10.Final-12· all · trixieFixed · Fixed:
3.6.10.Final-11dsa · libhibernate3-java · debian · 13
3.6.10.Final-12· all · trixieFixed · Fixed:
3.6.10.Final-11dsa · libhibernate3-java · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_0225-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2020-25638]
- [https://osv.dev/vulnerability/DLA-2512-1]
- [https://osv.dev/vulnerability/DSA-4908-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:0225-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:0593-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2020-25638]
- [https://osv.dev/vulnerability/USN-6845-1]
- [https://security-tracker.debian.org/tracker/CVE-2020-25638]
- [https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-25638.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1016.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]