[GHSA-2p5w-cvg5-gc5c] A flaw was found in Hibernate. A remote attacker with low...#7408
Conversation
github-actions
bot
changed the base branch from
main
to
kmoens/advisory-improvement-7408
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates the GHSA advisory record with a clearer summary and properly scoped affected Hibernate ORM versions based on the referenced Red Hat CVE information.
Changes:
- Added a
summaryfield to the advisory JSON. - Populated
affectedwith Maven coordinates and a version range fororg.hibernate:hibernate-core.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "5.2.8" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "last_known_affected_version_range": "< 5.6.16" | ||
| } |
There was a problem hiding this comment.
The ranges[].events declares only introduced, which (per OSV semantics) implies the package remains affected indefinitely. Since the advisory text states affected versions are 5.2.8 through 5.6.15 (inclusive), encode an explicit upper bound in events (e.g., add a fixed: \"5.6.16\" or use last_affected: \"5.6.15\"). Keeping the upper bound only in database_specific.last_known_affected_version_range can lead consumers that rely on ranges to incorrectly treat newer versions as vulnerable.
advisory-database
bot
merged commit b55f1bf
into
kmoens/advisory-improvement-7408
|
Hi @kmoens! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
The Red Hat advisory at https://access.redhat.com/security/cve/cve-2026-0603 mentions: Affected Hibernate ORM versions are 5.2.8 through 5.6.15 (inclusive); earlier versions are not affected.