CVE-2022-23221: Critical severity h2database H2 vulnerability

Q: What is CVE-2022-23221?

CVE-2022-23221 is a vulnerability in H2 Console that allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL.

Q: How severe is CVE-2022-23221?

CVE-2022-23221 is considered critical with a severity score of 9.8.

Q: How can an attacker exploit CVE-2022-23221?

An attacker can exploit CVE-2022-23221 by using a specially crafted JDBC URL to execute arbitrary code remotely.

Q: Which software versions are affected by CVE-2022-23221?

EAP7 H2 Database versions 0:1.4.197-2.redhat_00004.1.el8ea and 0:1.4.197-2.redhat_00004.1.el7ea are affected, as well as H2 Database version up to 2.0.206 and H2 versions up to 2.1.210.

Q: How do I mitigate the CVE-2022-23221 vulnerability?

To mitigate the CVE-2022-23221 vulnerability, update to H2 Console version 2.1.210 or later.

Published Jan 19, 2022

Updated

A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script.

Other sources

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNOREUNKNOWNSETTINGS=TRUE;FORBIDCREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

Affected Software

10 affected componentsFixes available

maven/com.h2database:h2<2.1.210

2.1.210

redhat/eap7-h2database<0:1.4.197-2.redhat_00004.1.el8ea

0:1.4.197-2.redhat_00004.1.el8ea

redhat/eap7-h2database<0:1.4.197-2.redhat_00004.1.el7ea

0:1.4.197-2.redhat_00004.1.el7ea

debian/h2database

1.4.197-4+deb10u11.4.197-4+deb11u12.1.214-12.2.220-1

redhat/h2<2.1.210

2.1.210

h2database H2>=1.1.100<2.0.206

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

Oracle Communications Cloud Native Core Console=1.9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/com.h2database:h2 to a version that resolves this vulnerability.
Fixed in 2.1.210
Upgrade
Upgrade redhat/eap7-h2database to a version that resolves this vulnerability.
Fixed in 0:1.4.197-2.redhat_00004.1.el8ea
Upgrade
Upgrade redhat/eap7-h2database to a version that resolves this vulnerability.
Fixed in 0:1.4.197-2.redhat_00004.1.el7ea
Upgrade
Upgrade debian/h2database to a version that resolves this vulnerability.
Fixed in 1.4.197-4+deb10u1Fixed in 1.4.197-4+deb11u1Fixed in 2.1.214-1Fixed in 2.2.220-1
Upgrade
Upgrade redhat/h2 to a version that resolves this vulnerability.
Fixed in 2.1.210
Upgrade
Upgrade h2database/h2database (H2 Console) to a version that resolves this vulnerability.
Fixed in 2.1.210
Compensating control
Prevent remote access to the H2 Console until updated to a version that is not "before 2.1.210" (e.g., restrict network/firewall access to the Console endpoint).

Event History

Jan 19, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Jan 21, 2022

Advisory Published

11:07 PM

Jan 24, 2022

Data Sourced

via Red Hat·07:46 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2022-23221?