A vulnerability was found in Hibernate. An SQL Injection in the implementation of JPQL LIKE expressions when running against MS-SQL Server due to an improper escape of wildcards. This could lead to an information disclosure.
Statement: Red Hat OpenStack's OpenDaylight has the provision to use JPQL. However, using OpenDaylight with Microsoft MS-SQL is not a supported configuration. Red Hat Satellite 6 does not support using MS-SQL as a database provider, hence the aforementioned product is not affected by this issue.
Acknowledgments: Name: Jens Schauder (pivotal.io), Mark Paluch (pivotal.io)
This vulnerability is out of security support scope for the following product: * Red Hat JBoss Fuse Service Works 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
It is not a vulnerability in Hibernate code for the following reason: * It is the user code that passes the [] or [^] constructs into Hibernate. Which might be completely valid constructs in terms of SQL Server. The actual SQL injection is one of the user code, not Hibernate, as Hibernate has no way to assert what is actually intended by the user code. * See also https://docs.microsoft.com/en-us/sql/relational-databases/security/sql-injection#like-clauses * Further more, the characters are treated as a wildcard by SQL Server, as documented. These characters are not prohibited by other databases. Other databases simply treat them as literal characters. It works as advertised by SQL Server.