# Validator and CVE-2017-7536

**URL:** <https://discourse.hibernate.org/t/validator-and-cve-2017-7536/219>\
**Category:** Hibernate Validator\
**Created:** [February 9, 2018, 9:08pm UTC](https://discourse.hibernate.org/t/validator-and-cve-2017-7536/219 "2018-02-09T21:08:39Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ddillard](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.hibernate.org/ddillard/32/139_2.png) [@ddillard](https://discourse.hibernate.org/u/ddillard)\
**Post date:** [February 9, 2018, 9:08pm UTC](https://discourse.hibernate.org/t/validator-and-cve-2017-7536/219/1 "2018-02-09T21:08:39Z")

</div>

I just saw that there is vulnerability [CVE-2017-7536](https://nvd.nist.gov/vuln/detail/CVE-2017-7536) against Validator. According to the link it affects the latest versions of 5.4 and 5.3. Per [the releases page](https://nvd.nist.gov/vuln/detail/CVE-2017-7536) 5.4 is a stable (I’m reading that as supported) release, so is a fix planned for 5.4? Or is the only supported branch now 6.0?

---

<div class="post-metadata">

**Author:** ![gsmet](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.hibernate.org/gsmet/32/9_2.png) [@gsmet](https://discourse.hibernate.org/u/gsmet)\
**Post date:** [February 9, 2018, 9:24pm UTC](https://discourse.hibernate.org/t/validator-and-cve-2017-7536/219/2 "2018-02-09T21:24:44Z")

</div>

This issue has been fixed in Hibernate Validator 5.4.2.Final, which has been released in October 2017.

You should be aware that the issue only makes sense when you are using the security manager so it doesn’t affect a lot of use cases anyway.

That being said, I strongly encourage you to upgrade to the latest and greatest Hibernate Validator 6.0.x, apart from the new features, it’s faster and consumes less memory.

---

<div class="post-metadata">

**Author:** ![ddillard](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.hibernate.org/ddillard/32/139_2.png) [@ddillard](https://discourse.hibernate.org/u/ddillard)\
**Post date:** [February 9, 2018, 10:41pm UTC](https://discourse.hibernate.org/t/validator-and-cve-2017-7536/219/3 "2018-02-09T22:41:54Z")

</div>

Thanks. You might want to let your security people know so they can have the CVE updated as the CVE says that 5.4.2 is affected as well.

Do you know if 5.3.6 includes a fix too? Again, the CVE says it doesn’t, but since 5.3.6 was released about the same time as 5.4.2 I’m thinking that it does.

---

<div class="post-metadata">

**Author:** ![gsmet](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.hibernate.org/gsmet/32/9_2.png) [@gsmet](https://discourse.hibernate.org/u/gsmet)\
**Post date:** [February 10, 2018, 12:46pm UTC](https://discourse.hibernate.org/t/validator-and-cve-2017-7536/219/4 "2018-02-10T12:46:13Z")

</div>

To be clear, here are the statuses of the different branches regarding CVE-2017-7536:

- 5.3: fixed in 5.3.6.Final
- 5.4: fixed in 5.4.2.Final
- 6.0: never affected

I’ll try to get the CVE updated.

---

<div class="post-metadata">

**Author:** ![gsmet](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.hibernate.org/gsmet/32/9_2.png) [@gsmet](https://discourse.hibernate.org/u/gsmet)\
**Post date:** [February 12, 2018, 2:51pm UTC](https://discourse.hibernate.org/t/validator-and-cve-2017-7536/219/5 "2018-02-12T14:51:06Z")

</div>

So… I checked the CVE and basically it is all wrong as it states that 5.2.5.Final is not affected, whereas it is.

So here is the definite reference for the branches:

- 5.2: affected: up to 5.2.5.Final included; fixed in JBoss EAP, we haven’t released any community versions but the fix is in the master branch
- 5.3: affected: up to 5.3.5.Final; fixed in 5.3.6.Final
- 5.4: affected: up to 5.4.1.Final; fixed in 5.4.2.Final
- 6.0: never affected

@ddillard thanks for reporting the issue with the CVE, I asked for it to be corrected. I hope it will get fixed soon.

Once again, this CVE only concerns people running their applications with the security manager enabled so it should be of no concerns for the vast majority of users.

---

<div class="post-metadata">

**Author:** ![Rakova](https://avatars.discourse-cdn.com/v4/letter/r/b9e5f3/32.png) [@Rakova](https://discourse.hibernate.org/u/Rakova)\
**Post date:** [September 6, 2018, 10:01am UTC](https://discourse.hibernate.org/t/validator-and-cve-2017-7536/219/6 "2018-09-06T10:01:34Z")

</div>

Hello everyone. From the git hub I have found that 4.3.4.Final version contains the fix for CVE-2017-7536, but there is no such artifact in Maven Central or even JBoss Maven repository. Is this version going to be released? Thanks.

---

<div class="post-metadata">

**Author:** ![gsmet](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.hibernate.org/gsmet/32/9_2.png) [@gsmet](https://discourse.hibernate.org/u/gsmet)\
**Post date:** [September 6, 2018, 10:20am UTC](https://discourse.hibernate.org/t/validator-and-cve-2017-7536/219/7 "2018-09-06T10:20:06Z")

</div>

I don’t plan to release it to Central. It’s a very old, unsupported version from the community point of view.

Are you using the security manager? Because if not, this CVE does not affect you.

---

<div class="post-metadata">

**Author:** ![Rakova](https://avatars.discourse-cdn.com/v4/letter/r/b9e5f3/32.png) [@Rakova](https://discourse.hibernate.org/u/Rakova)\
**Post date:** [September 6, 2018, 10:41am UTC](https://discourse.hibernate.org/t/validator-and-cve-2017-7536/219/8 "2018-09-06T10:41:32Z")

</div>

We use security manager and unfortunately cannot migrate to newer versions. If it is not going to be released to Central can we expect that it will appear in JBoss repository?

---

<div class="post-metadata">

**Author:** ![gsmet](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.hibernate.org/gsmet/32/9_2.png) [@gsmet](https://discourse.hibernate.org/u/gsmet)\
**Post date:** [September 6, 2018, 12:20pm UTC](https://discourse.hibernate.org/t/validator-and-cve-2017-7536/219/9 "2018-09-06T12:20:32Z")

</div>

To be honest, I only pushed the fix there because it’s part of a still maintained JBoss EAP version.

If you need it, grab the tag and push it to an internal repository. We don’t maintain community versions of versions that are so old.