Is this security vulnerability applicable to Hibernate 4.2? If so, ss there any plan to backport this fix to Hibernate 4.2?