{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7bd9fbe9-024c-5534-8f45-5b6dba5d50fb",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hibernate-core",
      "purl": "pkg:maven/org.hibernate/hibernate-core@6.6.38.Final-tuxcare.5",
      "type": "library",
      "group": "org.hibernate",
      "bom-ref": "pkg:maven/org.hibernate/hibernate-core@6.6.38.Final-tuxcare.5",
      "version": "6.6.38.Final-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "hibernate-core",
            "purl": "pkg:maven/org.hibernate/hibernate-core@6.6.38.Final",
            "type": "library",
            "group": "org.hibernate",
            "version": "6.6.38.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-14900",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.6.38.Final-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:ba87fde4-a819-577c-802a-c736e08462e8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-14900 does not affect version 6.6.38.Final-tuxcare.5 of org.hibernate:hibernate-core. not_affected \u2014 CVE-2019-14900 SQL injection vulnerability is NOT present in Hibernate ORM 6.6.38.Final-tuxcare.3. The vulnerability was fixed in upstream commits (eebf01fbf3 and 3f3c1ab506) in June 2020, which were already included in the upstream release that TuxCare onboarded. The target uses the modern Hibernate 6.x architecture where literal rendering delegates to dialect.appendLiteral(), which properly e...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-25638",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.6.38.Final-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:f7426ddc-474c-5708-9b78-09d9134d135b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-25638 does not affect version 6.6.38.Final-tuxcare.5 of org.hibernate:hibernate-core. The target repository (hibernate-orm 6.6.38.Final-tuxcare.3) is not affected by CVE-2020-25638. The vulnerability involves SQL injection through unsanitized literals in SQL comments when use_sql_comments is enabled. The upstream vendor (Hibernate) fixed this in commit 59fede7aca by adding an escapeComment() method that escapes comment delimiters (/* and */). This fix was already present in the upstream Hibernate 6.6.38.Final release before TuxCare onboarded it. The fix is comprehensively applied across all SQL builder classes (Insert, Delete, Update, SimpleSelect, AbstractSqlAstTranslator) in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0.Final, < 5.4.24.Final; < 5.3.20.Final), NVD (< 5.3.20; >= 5.4.0, < 5.4.24), cve.org (< 5.4.24.Final), Snyk (< 5.4.24.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-0603",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.6.38.Final-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:e5cc6940-2505-55f2-9605-d6fbbe3f810b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-0603 does not affect version 6.6.38.Final-tuxcare.5 of org.hibernate:hibernate-core. Hibernate 6.6.38.Final is not affected by CVE-2026-0603. The vulnerability existed in Hibernate 5.x where string/character type classes used unsafe string concatenation (e.g., `'\\'' + value + '\\''`) to build SQL literals, allowing SQL injection via embedded single quotes in ID values. Hibernate 6.x completely redesigned the type system architecture: it uses JdbcLiteralFormatter and centralized Dialect.appendLiteral() method (added in commit c5baae7e114 on 2021-09-30) that properly escapes single quotes by doubling them. This architectural fix was already present in the upstream 6.6.38.Final release that TuxCare onboarded. The vulnerable code patterns (IdsClauseBuilder, StringType.objectToSQLString, etc.) do not exist in Hibernate 6.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.8, < 5.3.38), Snyk (< 5.3.38).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hibernate/hibernate-core@6.6.38.Final-tuxcare.5"
    }
  ]
}