Bug 23724 - hibernate-validator new security issues CVE-2017-7536 and CVE-2020-10693
Summary: hibernate-validator new security issues CVE-2017-7536 and CVE-2020-10693
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: Java Stack Maintainers
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-10-17 23:41 CEST by David Walser
Modified: 2021-07-01 18:17 CEST (History)
1 user (show)

See Also:
Source RPM: hibernate-validator-5.2.4-1.mga7.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2018-10-17 23:41:09 CEST 
RedHat Satellite 6.4 fixed a security issue in hibernate-validator:
https://access.redhat.com/errata/RHSA-2018:2927
https://bugzilla.redhat.com/show_bug.cgi?id=1465573

Mageia 6 is also affected.
David Walser 2018-10-17 23:41:16 CEST

Whiteboard: (none) => MGA6TOO

David Walser 2019-06-23 19:31:23 CEST

Whiteboard: MGA6TOO => MGA7TOO, MGA6TOO

Nicolas Lécureuil 2020-05-22 14:08:48 CEST

Whiteboard: MGA7TOO, MGA6TOO => MGA7TOO
CC: (none) => mageia

Comment 1 David Walser 2020-10-29 02:07:14 CET 
This package has been (mercifully) dropped in Cauldron.

RedHat has issued an advisory on October 27:
https://access.redhat.com/errata/RHSA-2020:4366

It fixes a new issue in hibernate-validator that was fixed upstream in 6.0.20.

The original CVE in this bug was fixed upstream in 5.3.5.

Summary: hibernate-validator new security issue CVE-2017-7536 => hibernate-validator new security issues CVE-2017-7536 and CVE-2020-10693
Source RPM: hibernate-validator-5.0.1-9.mga7.src.rpm => hibernate-validator-5.2.4-1.mga7.src.rpm
Version: Cauldron => 7

David Walser 2020-10-29 02:07:37 CET

Whiteboard: MGA7TOO => (none)

Comment 2 David Walser 2021-07-01 18:17:05 CEST 
https://blog.mageia.org/en/2021/06/08/mageia-7-will-reach-end-of-support-on-30th-of-june-the-king-is-dead-long-live-the-king/

Status: NEW => RESOLVED
Resolution: (none) => OLD
Note You need to log in before you can comment on or make changes to this bug.