OESA-2021-1332

Dashboard / Vulnerabilities / OESA-2021-1332

OESA-2021-1332

Summary: hibernate-validator security update

Details: This is the reference implementation of JSR-349 - Bean Validation 1.1. Bean Validation defines a meta-data model and API for JavaBean as well as method validation. The default meta-data source are annotations, with the ability to override and extend the meta-data through the use of XML validation descriptors. Security Fix(es): A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.(CVE-2019-10219)

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1332, https://nvd.nist.gov/vuln/detail/CVE-2019-10219