JVN#90729322: Hibernate ORM vulnerable to SQL injection

Hibernate ORM is an ORM framework for Java.
Hibernate ORM can be configured (hibernate.use_sql_comments to true, which is false by default) to add comments to generated SQL statements, aimed at debugging purpose.
When hibernate.use_sql_comments is configured to true, malicious input may produce unexpected SQL statements (CWE-89).

Impact

When hibernate.use_sql_comments is configured to true, malicious input may lead to SQL injection.

Solution

Update the Software
Update the Hibernate ORM to the latest version, according to the information from the developer.

Workarounds
set hibername.use_sql_comments to false.

Products Affected

• Hibernate ORM, versions prior to 5.4.24
• Hibernate ORM, versions prior to 5.3.20