CVE-2024-39677 (Medium) detected in nhibernate.3.3.3.4001.nupkg, NHibernate-3.3.3.4001.dll

[mend-bolt-for-github]

CVE-2024-39677 - Medium Severity Vulnerability

Vulnerable Libraries - nhibernate.3.3.3.4001.nupkg, NHibernate-3.3.3.4001.dll

nhibernate.3.3.3.4001.nupkg

NHibernate is a mature, open source object-relational mapper for the .NET framework. It is actively ...

Library home page: https://api.nuget.org/packages/nhibernate.3.3.3.4001.nupkg

Path to vulnerable library: /src/archive/OpenRiaServices.NHibernate/packages/NHibernate.3.3.3.4001/NHibernate.3.3.3.4001.nupkg

Dependency Hierarchy:

• ❌ nhibernate.3.3.3.4001.nupkg (Vulnerable Library)

NHibernate-3.3.3.4001.dll

NHibernate

Library home page: https://api.nuget.org/packages/nhibernate.3.3.3.4001.nupkg

Path to vulnerable library: /src/archive/OpenRiaServices.NHibernate/packages/NHibernate.3.3.3.4001/lib/Net35/NHibernate.dll

Dependency Hierarchy:

• ❌ NHibernate-3.3.3.4001.dll (Vulnerable Library)

Found in HEAD commit: 049dcf89af74909dfa914cd5044d3f836d134b3a

Found in base branch: main

Vulnerability Details

NHibernate is an object-relational mapper for the .NET framework. A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. Callers of these methods are exposed to the vulnerability, which includes mappings using inheritance with discriminator values; HQL queries referencing a static field of the application; users of the SqlInsertBuilder and SqlUpdateBuilder utilities, calling their AddColumn overload taking a literal value; and any direct use of the ObjectToSQLString methods for building SQL queries on the user side. This vulnerability is fixed in 5.4.9 and 5.5.2.

Publish Date: 2024-07-08

URL: CVE-2024-39677

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fg4q-ccq8-3r5q

Release Date: 2024-07-08

Fix Resolution: NHibernate - 5.4.9,5.5.2

---

Step up your Open Source Security Game with Mend here