Description

ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.

Remediation

References

https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3558.yaml

http://rhn.redhat.com/errata/RHSA-2014-1286.html

http://rhn.redhat.com/errata/RHSA-2014-1285.html

https://hibernate.atlassian.net/browse/HV-912

http://rhn.redhat.com/errata/RHSA-2014-1288.html

http://rhn.redhat.com/errata/RHSA-2014-1287.html

http://rhn.redhat.com/errata/RHSA-2015-0125.html

http://rhn.redhat.com/errata/RHSA-2015-0720.html

Related Vulnerabilities

CVE-2020-7774 Vulnerability in maven package org.webjars.npm:y18n

CVE-2018-3772 Vulnerability in npm package whereis

CVE-2020-28452 Vulnerability in maven package com.softwaremill.akka-http-session:core_2.11

CVE-2018-1000632 Vulnerability in maven package org.dom4j:dom4j

CVE-2021-27292 Vulnerability in npm package ua-parser-js

Severity

Critical

Classification

CWE-264

Tags

Third Party Advisory