fix: bump org.hibernate:hibernate-core to 5.5.0.Beta1 (CVE-2019-14900) - #28

Automated dependency fix — CVE-2019-14900

Package: org.hibernate:hibernate-core 4.0.1.Final → 5.5.0.Beta1
Severity: medium
Lane: advised-bump

Assessment

• Exploitability: Exploitation requires an application that passes attacker-controlled input into JPA Criteria literal queries, which is a non-default and relatively uncommon code path.
• Business impact: Successful SQL injection could allow unauthorized data access, modification, or extraction from the backing database.
• Confidence: 0.85
• Rationale: This is a legitimate, well-documented Hibernate ORM SQL injection CVE with a clear fixed version, and the project uses a very old vulnerable release (4.0.1.Final). However, the jump to 5.5.0.Beta1 is a major upgrade with significant API changes, so automated remediation should be staged carefully.

Advisory

• Breaking-change risk: high
• Bumps org.hibernate:hibernate-core from 4.0.1.Final to 5.5.0.Beta1 to remediate CVE-2019-14900 (SQL injection via JPA Criteria literals). This is a major version jump across Hibernate 4.x → 5.x with known API/behavioral changes (e.g., session, query, and bootstrap APIs), so thorough integration testing is required before merging.

Validation

• Patched branch installs, but the test suite fails.

Opened by the vulnerability management platform after human approval.