Candidate: CVE-2017-7536
PublicDate: 2018-01-10 15:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7536
Description:
 In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was
 found that when the security manager's reflective permissions, which allows
 it to access the private members of the class, are granted to Hibernate
 Validator, a potential privilege escalation can occur. By allowing the
 calling code to access those private members without the permission an
 attacker may be able to validate an invalid instance and access the private
 member value via ConstraintViolation#getInvalidValue().
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by: Gunnar Morling
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H [7.0 HIGH]
 nvd: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H [7.0 HIGH]

Patches_libhibernate-validator-java:
 upstream: https://github.com/hibernate/hibernate-validator/commit/0ed45f37c4680998167179e631113a2c9cb5d113
upstream_libhibernate-validator-java: released (4.3.3-4)
precise/esm_libhibernate-validator-java: DNE
trusty_libhibernate-validator-java: not-affected (vulnerable code introduced in 4.3)
trusty/esm_libhibernate-validator-java: DNE (trusty was not-affected [vulnerable code introduced in 4.3])
vivid/ubuntu-core_libhibernate-validator-java: DNE
xenial_libhibernate-validator-java: not-affected (vulnerable code introduced in 4.3)
zesty_libhibernate-validator-java: ignored (reached end-of-life)
artful_libhibernate-validator-java: ignored (reached end-of-life)
bionic_libhibernate-validator-java: not-affected (4.3.3-4)
cosmic_libhibernate-validator-java: not-affected (4.3.3-4)
devel_libhibernate-validator-java: not-affected (4.3.3-4)