cvelist/2019/10xxx/CVE-2019-10219.json

{
    "data_type": "CVE",
    "data_format": "MITRE",
    "data_version": "4.0",
    "CVE_data_meta": {
        "ID": "CVE-2019-10219",
        "ASSIGNER": "secalert@redhat.com",
        "STATE": "PUBLIC"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "Hibernate",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "hibernate-validator",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_value": "n/a"
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-79"
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219",
                "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219",
                "refsource": "CONFIRM"
            },
            {
                "refsource": "MLIST",
                "name": "[accumulo-notifications] 20200108 [GitHub] [accumulo] milleruntime opened a new pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
                "url": "https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf@%3Cnotifications.accumulo.apache.org%3E"
            },
            {
                "refsource": "MLIST",
                "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime closed pull request #1469: Update hibernate-validator. Fixes CVE-2019-10219",
                "url": "https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6@%3Cnotifications.accumulo.apache.org%3E"
            },
            {
                "refsource": "MLIST",
                "name": "[accumulo-notifications] 20200109 [GitHub] [accumulo] milleruntime commented on issue #1469: Update hibernate-validator. Fixes CVE-2019-10219",
                "url": "https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d@%3Cnotifications.accumulo.apache.org%3E"
            },
            {
                "refsource": "REDHAT",
                "name": "RHSA-2020:0164",
                "url": "https://access.redhat.com/errata/RHSA-2020:0164"
            },
            {
                "refsource": "REDHAT",
                "name": "RHSA-2020:0159",
                "url": "https://access.redhat.com/errata/RHSA-2020:0159"
            },
            {
                "refsource": "REDHAT",
                "name": "RHSA-2020:0160",
                "url": "https://access.redhat.com/errata/RHSA-2020:0160"
            },
            {
                "refsource": "REDHAT",
                "name": "RHSA-2020:0161",
                "url": "https://access.redhat.com/errata/RHSA-2020:0161"
            },
            {
                "refsource": "REDHAT",
                "name": "RHSA-2020:0445",
                "url": "https://access.redhat.com/errata/RHSA-2020:0445"
            },
            {
                "refsource": "MLIST",
                "name": "[portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
                "url": "https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
                "refsource": "MLIST",
                "name": "[portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-791) Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
                "url": "https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c@%3Cpluto-dev.portals.apache.org%3E"
            },
            {
                "refsource": "MLIST",
                "name": "[portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-791 Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219",
                "url": "https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4@%3Cpluto-scm.portals.apache.org%3E"
            },
            {
                "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            }
        ]
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack."
            }
        ]
    },
    "impact": {
        "cvss": [
            [
                {
                    "vectorString": "6.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                    "version": "3.0"
                }
            ]
        ]
    }
}