{
  "threat_severity" : "Important",
  "public_date" : "2020-10-01T00:00:00Z",
  "bugzilla" : {
    "description" : "hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used",
    "id" : "1881353",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1881353"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.4",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-89",
  "details" : [ "A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.", "A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity." ],
  "statement" : "For Red Hat Process Automation Manager and Red Hat Decision Manager, the kie-server-ee7 zip is primarily for Weblogic/Websphere which is decided to stay on hibernate 5.1.x, it's not possible to make an upgrade to 5.3.x due to technical reasons. For this reason this fix is included only for kie-server-ee7. For this reason there are two components for RHPAM and RHDM.",
  "affected_release" : [ {
    "product_name" : "EAP 7.3.3",
    "release_date" : "2020-11-23T00:00:00Z",
    "advisory" : "RHSA-2020:5174",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3",
    "package" : "hibernate-core"
  }, {
    "product_name" : "Red Hat build of Quarkus 1.7.5 SP1",
    "release_date" : "2020-12-01T00:00:00Z",
    "advisory" : "RHSA-2020:5302",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0",
    "package" : "hibernate-core"
  }, {
    "product_name" : "Red Hat Fuse 7.9",
    "release_date" : "2021-08-11T00:00:00Z",
    "advisory" : "RHSA-2021:3140",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7",
    "package" : "hibernate-core",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Integration",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2039",
    "cpe" : "cpe:/a:redhat:integration:1",
    "package" : "hibernate-core",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5344",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3",
    "package" : "hibernate-core"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-glassfish-el-0:3.0.1-4.b08_redhat_00005.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-hibernate-0:5.1.17-3.Final_redhat_00004.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-jackson-databind-0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-jboss-ejb-client-0:4.0.12-1.Final_redhat_00002.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-netty-0:4.1.63-2.Final_redhat_00003.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-undertow-0:1.4.18-16.SP14_redhat_00001.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-wildfly-0:7.1.11-4.GA_redhat_00002.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-wildfly-elytron-0:1.1.14-1.Final_redhat_00001.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-wildfly-http-client-0:1.0.21-1.Final_redhat_00001.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-wildfly-naming-client-0:1.0.13-1.Final_redhat_00001.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-wildfly-openssl-0:1.0.12-1.Final_redhat_00001.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9582",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7",
    "package" : "eap7-wildfly-openssl-linux-0:1.0.12-6.Final_redhat_00001.1.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-11-23T00:00:00Z",
    "advisory" : "RHSA-2020:5175",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-hibernate-0:5.3.18-2.Final_redhat_00002.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-activemq-artemis-0:2.9.0-6.redhat_00016.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-fge-btf-0:1.2.0-1.redhat_00007.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-fge-msg-simple-0:1.1.0-1.redhat_00007.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-hal-console-0:3.2.11-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-hibernate-validator-0:6.0.21-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jackson-annotations-0:2.10.4-1.redhat_00002.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jackson-core-0:2.10.4-1.redhat_00002.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jackson-coreutils-0:1.6.0-1.redhat_00006.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jackson-jaxrs-providers-0:2.10.4-1.redhat_00002.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jackson-modules-base-0:2.10.4-3.redhat_00002.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jackson-modules-java8-0:2.10.4-1.redhat_00002.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jasypt-0:1.9.3-1.redhat_00002.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jboss-marshalling-0:2.0.10-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jboss-remoting-0:5.0.19-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jboss-server-migration-0:1.7.2-3.Final_redhat_00004.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jboss-xnio-base-0:3.7.11-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-undertow-0:2.0.32-1.SP1_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-wildfly-0:7.3.4-3.GA_redhat_00003.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-wildfly-elytron-0:1.10.9-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5340",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-wildfly-openssl-0:1.0.12-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-11-23T00:00:00Z",
    "advisory" : "RHSA-2020:5175",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-hibernate-0:5.3.18-2.Final_redhat_00002.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-activemq-artemis-0:2.9.0-6.redhat_00016.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-fge-btf-0:1.2.0-1.redhat_00007.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-fge-msg-simple-0:1.1.0-1.redhat_00007.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-hal-console-0:3.2.11-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-hibernate-validator-0:6.0.21-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jackson-annotations-0:2.10.4-1.redhat_00002.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jackson-core-0:2.10.4-1.redhat_00002.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jackson-coreutils-0:1.6.0-1.redhat_00006.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jackson-jaxrs-providers-0:2.10.4-1.redhat_00002.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jackson-modules-base-0:2.10.4-3.redhat_00002.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jackson-modules-java8-0:2.10.4-1.redhat_00002.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jasypt-0:1.9.3-1.redhat_00002.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jboss-marshalling-0:2.0.10-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jboss-remoting-0:5.0.19-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jboss-server-migration-0:1.7.2-3.Final_redhat_00004.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jboss-xnio-base-0:3.7.11-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-undertow-0:2.0.32-1.SP1_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-wildfly-0:7.3.4-3.GA_redhat_00003.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-wildfly-elytron-0:1.10.9-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5341",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-wildfly-openssl-0:1.0.12-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-11-23T00:00:00Z",
    "advisory" : "RHSA-2020:5175",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-hibernate-0:5.3.18-2.Final_redhat_00002.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-activemq-artemis-0:2.9.0-6.redhat_00016.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-fge-btf-0:1.2.0-1.redhat_00007.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-fge-msg-simple-0:1.1.0-1.redhat_00007.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-hal-console-0:3.2.11-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-hibernate-validator-0:6.0.21-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jackson-annotations-0:2.10.4-1.redhat_00002.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jackson-core-0:2.10.4-1.redhat_00002.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jackson-coreutils-0:1.6.0-1.redhat_00006.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jackson-jaxrs-providers-0:2.10.4-1.redhat_00002.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jackson-modules-base-0:2.10.4-3.redhat_00002.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jackson-modules-java8-0:2.10.4-1.redhat_00002.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jasypt-0:1.9.3-1.redhat_00002.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jboss-marshalling-0:2.0.10-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jboss-remoting-0:5.0.19-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jboss-server-migration-0:1.7.2-3.Final_redhat_00004.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jboss-xnio-base-0:3.7.11-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-undertow-0:2.0.32-1.SP1_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-wildfly-0:7.3.4-3.GA_redhat_00003.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-wildfly-elytron-0:1.10.9-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2020-12-03T00:00:00Z",
    "advisory" : "RHSA-2020:5342",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-wildfly-openssl-0:1.0.12-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5",
    "release_date" : "2021-06-29T00:00:00Z",
    "advisory" : "RHSA-2021:2562",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.5",
    "package" : "hibernate-core",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.5 on RHEL 7",
    "release_date" : "2021-06-29T00:00:00Z",
    "advisory" : "RHSA-2021:2561",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.5::el7",
    "package" : "jws5-ecj-0:4.12.0-3.redhat_2.2.el7jws",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.5 on RHEL 7",
    "release_date" : "2021-06-29T00:00:00Z",
    "advisory" : "RHSA-2021:2561",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.5::el7",
    "package" : "jws5-mod_cluster-0:1.4.3-2.Final_redhat_00002.1.el7jws",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.5 on RHEL 7",
    "release_date" : "2021-06-29T00:00:00Z",
    "advisory" : "RHSA-2021:2561",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.5::el7",
    "package" : "jws5-tomcat-0:9.0.43-11.redhat_00011.1.el7jws",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.5 on RHEL 7",
    "release_date" : "2021-06-29T00:00:00Z",
    "advisory" : "RHSA-2021:2561",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.5::el7",
    "package" : "jws5-tomcat-native-0:1.2.26-3.redhat_3.el7jws",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.5 on RHEL 7",
    "release_date" : "2021-06-29T00:00:00Z",
    "advisory" : "RHSA-2021:2561",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.5::el7",
    "package" : "jws5-tomcat-vault-0:1.1.8-2.Final_redhat_00003.1.el7jws",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.5 on RHEL 8",
    "release_date" : "2021-06-29T00:00:00Z",
    "advisory" : "RHSA-2021:2561",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.5::el8",
    "package" : "jws5-ecj-0:4.12.0-3.redhat_2.2.el8jws",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.5 on RHEL 8",
    "release_date" : "2021-06-29T00:00:00Z",
    "advisory" : "RHSA-2021:2561",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.5::el8",
    "package" : "jws5-mod_cluster-0:1.4.3-2.Final_redhat_00002.1.el8jws",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.5 on RHEL 8",
    "release_date" : "2021-06-29T00:00:00Z",
    "advisory" : "RHSA-2021:2561",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.5::el8",
    "package" : "jws5-tomcat-0:9.0.43-11.redhat_00011.1.el8jws",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.5 on RHEL 8",
    "release_date" : "2021-06-29T00:00:00Z",
    "advisory" : "RHSA-2021:2561",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.5::el8",
    "package" : "jws5-tomcat-native-0:1.2.26-3.redhat_3.el8jws",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.5 on RHEL 8",
    "release_date" : "2021-06-29T00:00:00Z",
    "advisory" : "RHSA-2021:2561",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.5::el8",
    "package" : "jws5-tomcat-vault-0:1.1.8-2.Final_redhat_00003.1.el8jws",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Single Sign-On 7.4.3 one-off",
    "release_date" : "2020-11-30T00:00:00Z",
    "advisory" : "RHSA-2020:5254",
    "cpe" : "cpe:/a:redhat:jboss_single_sign_on:7.4",
    "package" : "hibernate-core"
  }, {
    "product_name" : "Red Hat support for Spring Boot 2.3.6",
    "release_date" : "2021-02-02T00:00:00Z",
    "advisory" : "RHSA-2021:0292",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0",
    "package" : "hibernate-core"
  }, {
    "product_name" : "RHDM 7.10.0",
    "release_date" : "2021-02-17T00:00:00Z",
    "advisory" : "RHSA-2021:0603",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:7.10",
    "package" : "hibernate-core-kie-server-ee8"
  }, {
    "product_name" : "RHPAM 7.10.0",
    "release_date" : "2021-02-17T00:00:00Z",
    "advisory" : "RHSA-2021:0600",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.10",
    "package" : "hibernate-core-kie-server-ee8"
  }, {
    "product_name" : "Text-Only RHOAR",
    "release_date" : "2020-12-16T00:00:00Z",
    "advisory" : "RHSA-2020:5361",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0"
  }, {
    "product_name" : "Text-Only RHOAR",
    "release_date" : "2021-01-07T00:00:00Z",
    "advisory" : "RHSA-2020:5388",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0"
  }, {
    "product_name" : "Text-Only RHSSO",
    "release_date" : "2020-12-15T00:00:00Z",
    "advisory" : "RHSA-2020:5533",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on",
    "package" : "hibernate-core"
  } ],
  "package_state" : [ {
    "product_name" : "A-MQ Clients 2",
    "fix_state" : "Not affected",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:a_mq_clients:2"
  }, {
    "product_name" : "Red Hat BPM Suite 6",
    "fix_state" : "Out of support scope",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform"
  }, {
    "product_name" : "Red Hat Decision Manager 7",
    "fix_state" : "Will not fix",
    "package_name" : "hibernate-core-kie-server-ee7",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:7"
  }, {
    "product_name" : "Red Hat Integration Camel K 1",
    "fix_state" : "Not affected",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:integration:1",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss BRMS 5",
    "fix_state" : "Out of support scope",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:5"
  }, {
    "product_name" : "Red Hat JBoss BRMS 6",
    "fix_state" : "Out of support scope",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Data Virtualization 6",
    "fix_state" : "Out of support scope",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:jboss_data_virtualization:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 5",
    "fix_state" : "Out of support scope",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:5"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Fuse 6",
    "fix_state" : "Out of support scope",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:jboss_fuse:6"
  }, {
    "product_name" : "Red Hat JBoss Fuse Service Works 6",
    "fix_state" : "Out of support scope",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:jboss_fuse_service_works:6"
  }, {
    "product_name" : "Red Hat JBoss Operations Network 3",
    "fix_state" : "Out of support scope",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:jboss_operations_network:3"
  }, {
    "product_name" : "Red Hat JBoss SOA Platform 5",
    "fix_state" : "Out of support scope",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_soa_platform:5"
  }, {
    "product_name" : "Red Hat OpenShift Application Runtimes",
    "fix_state" : "Affected",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0"
  }, {
    "product_name" : "Red Hat OpenStack Platform 10 (Newton)",
    "fix_state" : "Out of support scope",
    "package_name" : "opendaylight",
    "cpe" : "cpe:/a:redhat:openstack:10",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat OpenStack Platform 13 (Queens)",
    "fix_state" : "Will not fix",
    "package_name" : "opendaylight",
    "cpe" : "cpe:/a:redhat:openstack:13",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Process Automation 7",
    "fix_state" : "Will not fix",
    "package_name" : "hibernate-core-kie-server-ee7",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
  }, {
    "product_name" : "Red Hat support for Spring Boot",
    "fix_state" : "Affected",
    "package_name" : "hibernate-core",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2020-25638\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-25638" ],
  "name" : "CVE-2020-25638",
  "mitigation" : {
    "value" : "Set hibernate.use_sql_comments to false, which is the default value, or use named parameters instead of literals. Please refer to details in https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#configurations-logging and https://docs.jboss.org/hibernate/orm/5.4/userguide/html_single/Hibernate_User_Guide.html#sql-query-parameters.",
    "lang" : "en:us"
  },
  "csaw" : false
}