{
  "@id": "urn:uuid:45e2613d-a5da-4f8c-81b5-3b6132da9a8a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T22:16:00.093104+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.hibernate/hibernate-java8@5.5.6.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.hibernate/hibernate-java8@5.5.6.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T22:16:00.093104+00:00",
      "status_notes": "Vulnerability CVE-2019-14900 does not affect version 5.5.6.Final-tuxcare.1 of org.hibernate:hibernate-java8. not_affected \u2014 CVE-2019-14900 fix is present in Hibernate ORM 5.5.6.Final. The vulnerability (SQL injection via unsanitized literals in JPA Criteria API SELECT/GROUP BY clauses) was fixed in upstream commit 3f3c1ab506 which shipped with the upstream 5.5.6.Final release. The fix modifies LiteralExpression.renderProjection() to properly escape String and Character literals by delegating to dialect.inlineLiteral...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14900"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-14900 fix is present in Hibernate ORM 5.5.6.Final. The vulnerability (SQL injection via unsanitized literals in JPA Criteria API SELECT/GROUP BY clauses) was fixed in upstream commit 3f3c1ab506 which shipped with the upstream 5.5.6.Final release. The fix modifies LiteralExpression.renderProjection() to properly escape String and Character literals by delegating to dialect.inlineLiteral..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.hibernate/hibernate-java8@5.5.6.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.hibernate/hibernate-java8@5.5.6.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2020-25638 affects version 5.5.6.Final-tuxcare.1 of org.hibernate:hibernate-java8.",
      "vulnerability": {
        "name": "CVE-2020-25638"
      },
      "action_statement": "Vulnerability CVE-2020-25638 affects version 5.5.6.Final-tuxcare.1 of org.hibernate:hibernate-java8."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.hibernate/hibernate-java8@5.5.6.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.hibernate/hibernate-java8@5.5.6.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-0603 is fixed in version 5.5.6.Final-tuxcare.1 of org.hibernate:hibernate-java8.",
      "vulnerability": {
        "name": "CVE-2026-0603"
      }
    }
  ]
}