Hibernate vulnerability

[blootsvoets]

Hibernate has a SQL injection vulnerability in version 5.4.21, which is resolved in version 5.4.24:
https://app.snyk.io/vuln/SNYK-JAVA-ORGHIBERNATE-1041788

[alex-odysseus]

There were a few attempts to raise the version without success:

• Failed to get feature analysis data(ConversionFailedException) #1758
• "Entity graph specified is not applicable to the entity" warning #1780

We should get back to the topic when the current Spring Boot version 1.5.22.RELEASE is raised to 2.x

Until then the library spring-data-jpa-entity-graph (1.11.03) looks like a cornerstone correlating with Hibernate Core

[chrisknoll]

What is the confusion, @blootsvoets ?

[blootsvoets]

Ehm, no confusion, just sad that Spring Boot 1.5 and the latest Hibernate versions don't work together nicely.

[chrisknoll]

Agreed. For the 3.0 line we'll be bringing everything up to date: JDK 14+ etc.

[anthonysena]

Linking this to #2244