Critical
Security advisory
Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-11343
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:35 UTC · Revision 1
Source evidence
Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java.
osv:CVE-2019-11343
Complete source record
{
"id": "edf2c536e903a7647a50d865183cc4b7432f2d50b73fc8c00da2829cf9742680",
"url": "https://osv.dev/vulnerability/CVE-2019-11343",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-11343",
"summary": "Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java.",
"evidence": "osv:CVE-2019-11343",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2019-11343",
"aliases": [
"CVE-2019-11343",
"GHSA-j7m2-58wv-9v79"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/xjodoin/torpedoquery",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "c7fdda6bef2bc2b44089878f931b0b35c50a1ce2"
},
{
"fixed": "3c20b874fba9cc2a78b9ace10208de1602b56c3f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:torpedoquery:torpedo_query:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.5.3"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "3c20b874fba9cc2a78b9ace10208de1602b56c3f"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2.5.2",
"v2.5.1",
"v2.5.0",
"v2.4.0",
"v2.3.0",
"v2.2.1",
"v2.2.0",
"v2.1.0",
"v2.0.0",
"v1.7.0",
"org.torpedoquery-1.6.0",
"org.torpedoquery-1.5.1",
"v1.5.0",
"v1.4.1",
"v1.4.0",
"v1.3.2",
"v1.3.1",
"v1.3.0",
"v1.2.1",
"v1.2.0",
"v1.1.0",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11343.json",
"vanir_signatures": [
{
"id": "CVE-2019-11343-0e057f17",
"digest": {
"threshold": 0.9,
"line_hashes": [
"217559776959007376634397607752376878853",
"154193688315744292417120983480911393925",
"85227808638319143351436400361234778741",
"224325940672418478140207469490894755550"
]
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/ValueOnGoingConditionTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-0edf6159",
"digest": {
"length": 138,
"function_hash": "43018044944096108555650887486334032995"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/main/java/org/torpedoquery/jpa/internal/conditions/LikeCondition.java",
"function": "createQueryFragment"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-191c6a49",
"digest": {
"length": 319,
"function_hash": "304366733340722434406338576169333494360"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/StringFunctionsTest.java",
"function": "testWhereWithStringFunction"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-31098ffa",
"digest": {
"length": 302,
"function_hash": "288921583148202682196726703970537587453"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/WhereClauseTest.java",
"function": "test_notLike_endsWith"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-471a1768",
"digest": {
"length": 303,
"function_hash": "265160437719170818845742614203034955950"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/WhereClauseTest.java",
"function": "test_notLike_any"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-4eb84c51",
"digest": {
"threshold": 0.9,
"line_hashes": [
"158191768476921154835277657020348456721",
"188074174264371706929159051992196990046",
"63938170373741848146007958968468655181",
"274695395509779369863269466964722788882",
"112362906143237105365739811783367009888",
"162981121743963442536385918494186721310",
"236570687234409738165841958503072955466",
"296007145538245229284594464952452860213",
"284460458254333090465345589444844180976",
"37889916604908687963117211907456032147",
"294718206985807217222048152369027161571",
"48902628428638091681322788449643127200",
"142789683858716999709864420919198467950",
"72245245488328810836390073959715821741",
"316309279211867063466906016646393143806",
"144514594678214378224502496254055133949",
"256819852748018633133182970582258768941",
"39131064809761268014004496326623621421",
"222575597652534388090420905054079190377",
"15057551346433094436178956838615244663",
"306763285188670353437593583890445829851",
"125478713356798053752770712080541494429",
"144507099795197228082720957502042766978",
"7093990029110155827508925256610593677",
"196968565946474151464200991682683349551",
"177763704477592105180853237933860057758",
"102088998691452957703587009647135455676",
"187794824112036416764639946427278622077"
]
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/main/java/org/torpedoquery/jpa/internal/conditions/LikeCondition.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-63551cdd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"273816533047112130330497565710627334086",
"267714954255899184765657147053715455772",
"25602535072437739303386203263105461522",
"86481408299419176642942209737542340229",
"149527335218956097061471245739386647745",
"93519138869206791775783677009407967339",
"223137970908625885288790143702135412442",
"281264174160944700083453689203091595994",
"163508055529468304385799526553517701186",
"39546577277928692830460630153065054780",
"117634215025626324368607130573415375362",
"11930913408753264842052360037098481077",
"259250617085730971908557780719080299756",
"67378403509466058820646089811652081831",
"6850860390816755846477241236404249044",
"55402059494338806103509823814131040640",
"44129433656906188612226575430048970170",
"74481766087167631355610015824428527770",
"295437297700801237940691707966129992064",
"91819160066734252549676626901901328057",
"194020144092981477353426657786928598974",
"97148845600855981562744312133201593209",
"251711495175303524828871605906916623660",
"162794840178981171878972691152570114086"
]
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/WhereClauseTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-6443e863",
"digest": {
"threshold": 0.9,
"line_hashes": [
"107464878721142585270034723140179300746",
"151201986086035173123108114246040622280",
"316011294558734316513120221734332171283",
"175309201522830388986645060061317798757",
"155849608814535919230408886523144301661",
"87178702799363181074893465255671421298",
"316011294558734316513120221734332171283",
"36865446067887693099180334956043590195",
"3111055031575621982946354074540644418",
"170822743744359217529734609772952173910",
"309197020353405833687804628882964285079",
"278010268050743968824901855776290377601"
]
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/StringFunctionsTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-66d0a2e5",
"digest": {
"length": 350,
"function_hash": "255091968365249823470268678392361866031"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/ValueOnGoingConditionTest.java",
"function": "testLowerFunctionInCondition"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-7bba4606",
"digest": {
"length": 90,
"function_hash": "20712446925385009035174374967041199677"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/main/java/org/torpedoquery/jpa/internal/conditions/NotLikeCondition.java",
"function": "NotLikeCondition"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-8021906c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265866652966157350533539130787398556111",
"260521687602420898469471774061215180535",
"48844388539213700420546029855454674539",
"158053631377812350162378905938513314514",
"50304113272933339725427061503191618078",
"329692004852178383421127571813666418993"
]
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/main/java/org/torpedoquery/jpa/internal/conditions/ConditionBuilder.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-827fe479",
"digest": {
"length": 306,
"function_hash": "331095399819162217935759416592919666234"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/StringFunctionsTest.java",
"function": "testWhereWithLikeFunction"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-9d34e64f",
"digest": {
"length": 298,
"function_hash": "312170304072288922318230128478291900110"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/WhereClauseTest.java",
"function": "test_like_startsWith"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-9e9c702e",
"digest": {
"length": 58,
"function_hash": "327542834048855177303680042815055071833"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/main/java/org/torpedoquery/jpa/internal/conditions/LikeCondition.java",
"function": "getParameters"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-ac041ebf",
"digest": {
"length": 298,
"function_hash": "218257778150286294674095739995465372853"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/WhereClauseTest.java",
"function": "test_like_endsWith"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-c1731202",
"digest": {
"length": 175,
"function_hash": "114040544832601790862149175321875062357"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/main/java/org/torpedoquery/jpa/internal/conditions/ConditionBuilder.java",
"function": "createLike"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-d6d04684",
"digest": {
"length": 310,
"function_hash": "186359827210264212039276490246362564205"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/StringFunctionsTest.java",
"function": "testWhereWithNotLikeFunction"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-eae537eb",
"digest": {
"length": 299,
"function_hash": "146921001949452160116537313650151620064"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/WhereClauseTest.java",
"function": "test_like_any"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-f1bd6a2b",
"digest": {
"length": 125,
"function_hash": "276849226725221505050513190310608889350"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/main/java/org/torpedoquery/jpa/internal/conditions/LikeCondition.java",
"function": "LikeCondition"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-fc2a86d3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"200367275519262231913651114133275996774",
"185112692837185542700016052317825420142",
"147567440528145201484901589570421079003",
"87857449971315108434190726694642628284",
"101812655583331627213228916774239160320",
"206577044265289914800376962997250520371",
"118099037431796987347822046741410454628",
"88550428755695114657769099068752938664"
]
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/main/java/org/torpedoquery/jpa/internal/conditions/NotLikeCondition.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-11343-fc5532b2",
"digest": {
"length": 302,
"function_hash": "194700668405478309755886878062719337447"
},
"source": "https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"target": {
"file": "src/test/java/org/torpedoquery/jpa/WhereClauseTest.java",
"function": "test_notLike_startsWith"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:56:14Z"
}
}
],
"modified": "2026-10-20T13:56:14.793009151Z",
"provider": "osv",
"references": [
"https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f",
"https://github.com/xjodoin/torpedoquery/compare/v2.5.2...v2.5.3"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-11343",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388408,
"published_at": "2020-03-12T21:15:12.703+00:00"
}