{
  "@id": "urn:uuid:5926363b-2e97-436d-92d7-9a433777a87d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T22:15:00.125064+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.hibernate/hibernate-java8@5.5.9.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.hibernate/hibernate-java8@5.5.9.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T22:15:00.125064+00:00",
      "status_notes": "Vulnerability CVE-2019-14900 does not affect version 5.5.9.Final-tuxcare.1 of org.hibernate:hibernate-java8. not_affected \u2014 CVE-2019-14900 is not present in Hibernate ORM 5.5.9.Final. The vulnerability involved SQL injection through unsanitized string/character literals in JPA Criteria API SELECT and GROUP BY clauses. The upstream fix (commit 3f3c1ab506) was already included in the 5.5.9.Final release that TuxCare onboarded. The target code shows string/character literals are properly passed through dialect.inlineLi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14900"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-14900 is not present in Hibernate ORM 5.5.9.Final. The vulnerability involved SQL injection through unsanitized string/character literals in JPA Criteria API SELECT and GROUP BY clauses. The upstream fix (commit 3f3c1ab506) was already included in the 5.5.9.Final release that TuxCare onboarded. The target code shows string/character literals are properly passed through dialect.inlineLi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.hibernate/hibernate-java8@5.5.9.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.hibernate/hibernate-java8@5.5.9.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2020-25638 affects version 5.5.9.Final-tuxcare.1 of org.hibernate:hibernate-java8.",
      "vulnerability": {
        "name": "CVE-2020-25638"
      },
      "action_statement": "Vulnerability CVE-2020-25638 affects version 5.5.9.Final-tuxcare.1 of org.hibernate:hibernate-java8."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.hibernate/hibernate-java8@5.5.9.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.hibernate/hibernate-java8@5.5.9.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-0603 is fixed in version 5.5.9.Final-tuxcare.1 of org.hibernate:hibernate-java8.",
      "vulnerability": {
        "name": "CVE-2026-0603"
      }
    }
  ]
}