Comment From: wilkinsona

Superseded by https://github.com/spring-projects/spring-boot/issues/21952.

Comment From: izeye

This seems to supersede #21952, not to be superseded by it.

Comment From: wilkinsona

Oops. Thanks, @izeye.

Comment From: Inkromind

Could this also be applied to 2.3.x? This would fix CVE-2019-14900.

Comment From: snicoll

@Inkromind that CVE is also fixed in 5.3.18.Final which we will pick in due course. You can override the version in your project using hibernate.version for the time being.