Open-source package vulnerability · Maven

GHSA-wpvf-5mc3-hv6m: Duplicate Advisory: Querydsl SQL/HQL injection

criticalCVSS 3.1 9.8

This advisory was withdrawn on Nov 27, 2024. The publisher no longer considers it a valid vulnerability.

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6q3q-6v5j-h6vg. This link is maintained to preserve external references. Original Description Querydsl 5.1.0 allows SQL/HQL injection in orderBy in JPAQuery.

Published Nov 20, 2024 · Updated Dec 3, 2024

Affected packages

com.querydsl:querydsl-jpa

Ecosystem: Maven
Affected: <= 5.1.0
Fixed in: No patched version yet
Check: mvn dependency:tree -Dincludes=com.querydsl:querydsl-jpa

com.querydsl:querydsl-apt

Ecosystem: Maven
Affected: <= 5.1.0
Fixed in: No patched version yet
Check: mvn dependency:tree -Dincludes=com.querydsl:querydsl-apt

io.github.openfeign.querydsl:querydsl-jpa

Ecosystem: Maven
Affected: <= 6.8
Fixed in: No patched version yet
Check: mvn dependency:tree -Dincludes=io.github.openfeign.querydsl:querydsl-jpa

io.github.openfeign.querydsl:querydsl-apt

Ecosystem: Maven
Affected: <= 6.8
Fixed in: No patched version yet
Check: mvn dependency:tree -Dincludes=io.github.openfeign.querydsl:querydsl-apt

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6q3q-6v5j-h6vg. This link is maintained to preserve external references.

Original Description

Querydsl 5.1.0 allows SQL/HQL injection in orderBy in JPAQuery.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology