fix: bump org.hibernate:hibernate-core to 5.4.24.Final (CVE-2020-25638) - #44

Automated dependency fix — CVE-2020-25638

Package: org.hibernate:hibernate-core 4.0.1.Final → 5.4.24.Final
Severity: high
Lane: advised-bump

Assessment

• Exploitability: Exploitation requires the application to enable hibernate.use_sql_comments and pass untrusted input into JPQL string literals, a specific but plausible configuration.
• Business impact: Successful SQL injection could allow data exfiltration, tampering, or unauthorized access to backend databases.
• Confidence: 0.85
• Rationale: This is a real, well-documented Hibernate SQL injection CVE with a clear fixed version, and the installed 4.0.1.Final is far behind the 5.4.24.Final fix. Severity remains high due to the impact of SQL injection, though real-world exploitability depends on non-default configuration and the finding is not marked reachable.

Advisory

• Breaking-change risk: high
• Bumps org.hibernate:hibernate-core from 4.0.1.Final to 5.4.24.Final to remediate CVE-2020-25638 (SQL injection via hibernate.use_sql_comments with JPQL string literals). This crosses two major versions (4.x → 5.x), which includes significant API, configuration, and JPA behavior changes, so integration testing is required before merging.

Validation

• Patched branch installs, but the test suite fails.

Opened by the vulnerability management platform after human approval.