CVE-2014-3558: Medium severity red hat hibernate validator vulnerability
IssueDescription:
It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions with escalated privileges, which might otherwise not be possible. This flaw could be used to perform various attacks, including but not restricted to, arbitrary code execution in systems that are otherwise secured by the Java Security Manager.
Other sources
ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3558?
CVE-2014-3558 is considered to have a moderate severity level.
How do I fix CVE-2014-3558?
To fix CVE-2014-3558, upgrade your Hibernate Validator to version 5.1.2 or 4.3.2 or later.
Which versions are affected by CVE-2014-3558?
CVE-2014-3558 affects Hibernate Validator versions prior to 5.1.2 and 4.3.2.
What is the impact of CVE-2014-3558?
The impact of CVE-2014-3558 could allow a malicious application to execute unauthorized code within the same application container.
Is CVE-2014-3558 a Java security issue?
Yes, CVE-2014-3558 is related to security vulnerabilities in the Java Security Manager when using Hibernate Validator.