Vulnerability · Published May 6, 2020 · Assigned by redhat
CVE-2020-10693
Medium 5.3
In plain English
A medium-severity improper input validation in hibernate-validator from Hibernate. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libhibernate-validator-java | no fix listed | DEBIAN-CVE-2020-10693 |
| Debian:13 | libhibernate-validator-java | no fix listed | DEBIAN-CVE-2020-10693 |
| Debian:14 | libhibernate-validator-java | no fix listed | DEBIAN-CVE-2020-10693 |
| Maven | org.hibernate.validator:hibernate-validator | 6.1.5.Final | GHSA-rmrm-75hp-phr2 |
| Maven | org.hibernate.validator:hibernate-validator | 6.0.20.Final | GHSA-rmrm-75hp-phr2 |
| Maven | org.hibernate:hibernate-validator | 6.0.20.Final | GHSA-rmrm-75hp-phr2 |
| Maven | org.hibernate:hibernate-validator | 6.1.5.Final | GHSA-rmrm-75hp-phr2 |
| Ubuntu:22.04:LTS | libhibernate-validator-java | no fix listed | UBUNTU-CVE-2020-10693 |
| Ubuntu:24.04:LTS | libhibernate-validator-java | no fix listed | UBUNTU-CVE-2020-10693 |
| Ubuntu:25.10 | libhibernate-validator-java | no fix listed | UBUNTU-CVE-2020-10693 |
| Ubuntu:26.04:LTS | libhibernate-validator-java | no fix listed | UBUNTU-CVE-2020-10693 |
| Ubuntu:26.10 | libhibernate-validator-java | no fix listed | UBUNTU-CVE-2020-10693 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hibernate | hibernate-validator | 6.1.2.Final |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- [portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219 mailing-list, x_refsource_MLIST
- [portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219 mailing-list, x_refsource_MLIST
- [portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-791 Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219 mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10693 x_refsource_CONFIRM