Prem (Community Member) asked a question.
Why is hibernate license marked as "High Risk" in SCA License reports
Hi
We have a couple of application profiles using hibernate-core-5.4.18-final.jar (http://hibernate.org/orm/releases/5.4/). It has LGPL 2.1 and later licenses are applicable. In Veracode SCA report , this is marked as High Risk where as Hibernate website says (https://hibernate.org/community/license/ ) "The use of the unmodified Hibernate binary of course never affects the license of your application or distribution. If you modify Hibernate and redistribute your modifications, the LGPL applies".
We haven't modified hibernate but just used it as maven dependency. How did Veracode determine that this is High Risk ?
Thanks
Prem
.png){kind=logo}
Hello @Prem (Community Member) ,
Veracode is not the one who determines if a vulnerability is considered high, but the National Vulnerability Database does. If you look on their website about hibernate-core, it will explain why it is considered a high risk. There is also more information about CWE-564 SQL Injection: Hibernate on the CWE (Common Weakness Enumeration) website that outlines that particular vulnerability.
If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.
Jason
Veracode Support Engineer
Thanks
Prem
Hi @Prem (Community Member) ,
In this Help Article Understanding SCA License Risk, we specifically call out information about understanding and determining license risk.
Jason
Veracode Support Engineer
Thanks Jason, I had reviewed the help section you have highlighted and in fact this post is a result of that review.
As per the help License risk rating should be "High" for "Strong Copy Left" licenses and it should be "medium" for "Weak copy left" licenses.
Hibernate-core-5.4.18.final.jar is licensed under LGPL 2.1 which is a "weak copy left" license. But still Veracode SCA report categorized Hibernate-core-5.4.18.final.jar as "High" risk.
In addition, license details page of hibernate (https://hibernate.org/community/license/) mentions that "The use of the unmodified Hibernate binary of course never affects the license of your application or distribution. You will never have to pay money to any commercial entity for using or integrating Hibernate."
Hi @Prem (Community Member) ,
Our engineering department downloaded “hibernate-core 5.4.18“ from Maven repo and scanned it accordingly. The Maven repo also indicated the License of LGPL 2.1. The Veracode platform also identified the LGPL2.1 license with High risk, see screenshots below.
Can you please confirm if you showed the same or if there were any differences? Thank you.
Jason
Veracode Support Engineer
Hi @Jason M., Veracode Support (Veracode) ,
We have the similar results as you mentioned.
Let me highlight again that my query is , "why veracode is marking hibernate-core library's LGPL 2.1 or 3.0 License as a High Risk license even though Veracode help says that only "Strong Copy Left" licenses are marked as High risk" .
If a support ticket is required I can raise that but I thought this is a straight forward question regarding the expected functionality and community will have some clue.
Regards
Prem
@Prem (Community Member) ,
In this case, Veracode’s legal team assigned that risk rating based on their interpretation of the licenses. LGPL may have IP-related constraints which may increase the risk.
Jason
Veracode Support Engineer