{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4bb2644d-8e38-595c-8857-8c81a0816e8f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hibernate-core",
      "purl": "pkg:maven/org.hibernate/hibernate-core@6.5.3.Final-tuxcare.3",
      "type": "library",
      "group": "org.hibernate",
      "bom-ref": "pkg:maven/org.hibernate/hibernate-core@6.5.3.Final-tuxcare.3",
      "version": "6.5.3.Final-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "hibernate-core",
            "purl": "pkg:maven/org.hibernate/hibernate-core@6.5.3.Final",
            "type": "library",
            "group": "org.hibernate",
            "version": "6.5.3.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-14900",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.5.3.Final-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d7d8afd7-8afc-544e-83fb-1cf4ef148852",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-14900 does not affect version 6.5.3.Final-tuxcare.3 of org.hibernate:hibernate-core. not_affected \u2014 CVE-2019-14900 does not affect this version. The SQL injection vulnerability in JPA Criteria API literal handling was fixed in upstream Hibernate ORM commit eebf01fbf3 (HHH-14077) by Andrea Boriero on 2020-06-19. This fix was already present in the 6.5.3.Final release that TuxCare onboarded. The target code uses dialect.appendLiteral() which properly escapes single quotes in literals, preventin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-25638",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.5.3.Final-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6be6c324-7308-5a33-96b5-2203f9998885",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-25638 does not affect version 6.5.3.Final-tuxcare.3 of org.hibernate:hibernate-core. Target version 6.5.3.Final is NOT AFFECTED by CVE-2020-25638. The upstream Hibernate project fixed this SQL injection vulnerability in commit 59fede7aca (authored by Andrea Boriero <andrea@hibernate.org> on 2020-09-29), which was already included in the upstream 6.5.3.Final release before TuxCare onboarded it on 2024-01-15 (commit c302528bc9). The fix adds Dialect.escapeComment() to escape SQL comment delimiters (/* and */) in all SQL statement builders, preventing attackers from breaking out of comment blocks to inject arbitrary SQL. All code paths that construct SQL comments correctly use this escaping method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0.Final, < 5.4.24.Final; < 5.3.20.Final), NVD (< 5.3.20; >= 5.4.0, < 5.4.24), cve.org (< 5.4.24.Final), Snyk (< 5.4.24.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-0603",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.5.3.Final-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e8266672-386d-5b90-813d-f27ff254d4e7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-0603 does not affect version 6.5.3.Final-tuxcare.3 of org.hibernate:hibernate-core. Hibernate ORM 6.5.3.Final is not affected by CVE-2026-0603. The vulnerability exists in Hibernate 5.x where Type classes (StringType, CharacterType, etc.) use manual string concatenation with quotes ('\\\\'' + value + '\\\\'') without escaping embedded single quotes, allowing SQL injection through crafted ID values. Hibernate 6.x eliminated this vulnerability through architectural redesign: it uses JdbcLiteralFormatter classes that delegate to Dialect.appendLiteral(), which properly escapes single quotes per SQL standard (by doubling them). The vulnerable code pattern does not exist in the 6.x codebase. All TuxCare CVE-2026-0603 backports target only Hibernate 5.x versions (5.4.x, 5.5.x, 5.6.x); no backports exist for any 6.x version, confirming 6.x was never vulnerable to this specific attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.8, < 5.3.38), Snyk (< 5.3.38).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hibernate/hibernate-core@6.5.3.Final-tuxcare.3"
    }
  ]
}