CVE-2022-41853: Remote code execution in HyperSQL DataBase

Published Oct 6, 2022
·
Updated

A flaw was found in the HSQLDB package. This flaw allows untrusted inputs to execute remote code due to any static method of any Java class in the classpath, resulting in code execution by default.

Other sources

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.methodclassnames" to classes which are allowed to be called. For example, System.setProperty("hsqldb.methodclassnames", "abc") or Java argument -Dhsqldb.methodclassnames="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.

Affected Software

67 affected componentsFixes available
redhat/hsqldb<1:1.8.0.10-13.el6_10
1:1.8.0.10-13.el6_10
redhat/hsqldb<1:1.8.1.3-15.el7_9
1:1.8.1.3-15.el7_9
redhat/eap7-activemq-artemis-native<1:1.0.2-3.redhat_00004.1.el8ea
1:1.0.2-3.redhat_00004.1.el8ea
redhat/eap7-apache-mime4j<0:0.8.9-1.redhat_00001.1.el8ea
0:0.8.9-1.redhat_00001.1.el8ea
redhat/eap7-artemis-native<1:1.0.2-4.redhat_00004.1.el8ea
1:1.0.2-4.redhat_00004.1.el8ea
redhat/eap7-artemis-wildfly-integration<0:1.0.7-1.redhat_00001.1.el8ea
0:1.0.7-1.redhat_00001.1.el8ea
redhat/eap7-infinispan<0:11.0.17-1.Final_redhat_00001.1.el8ea
0:11.0.17-1.Final_redhat_00001.1.el8ea
redhat/eap7-ironjacamar<0:1.5.11-1.Final_redhat_00001.1.el8ea
0:1.5.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-ejb-client<0:4.0.50-1.Final_redhat_00001.1.el8ea
0:4.0.50-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-metadata<0:13.4.0-1.Final_redhat_00001.1.el8ea
0:13.4.0-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.10.0-26.Final_redhat_00025.1.el8ea
0:1.10.0-26.Final_redhat_00025.1.el8ea
redhat/eap7-jbossws-cxf<0:5.4.8-1.Final_redhat_00001.1.el8ea
0:5.4.8-1.Final_redhat_00001.1.el8ea
redhat/eap7-jbossws-spi<0:3.4.0-2.Final_redhat_00001.1.el8ea
0:3.4.0-2.Final_redhat_00001.1.el8ea
redhat/eap7-netty<0:4.1.86-1.Final_redhat_00001.1.el8ea
0:4.1.86-1.Final_redhat_00001.1.el8ea
redhat/eap7-netty-transport-native-epoll<0:4.1.86-1.Final_redhat_00001.1.el8ea
0:4.1.86-1.Final_redhat_00001.1.el8ea
redhat/eap7-picketlink-federation<0:2.5.5-22.SP12_redhat_00012.1.el8ea
0:2.5.5-22.SP12_redhat_00012.1.el8ea
redhat/eap7-resteasy<0:3.15.5-1.Final_redhat_00001.1.el8ea
0:3.15.5-1.Final_redhat_00001.1.el8ea
redhat/eap7-snakeyaml<0:1.33.0-2.SP1_redhat_00001.1.el8ea
0:1.33.0-2.SP1_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el8ea
0:2.2.23-1.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el8ea
0:2.0.14-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.4.10-6.GA_redhat_00002.1.el8ea
0:7.4.10-6.GA_redhat_00002.1.el8ea
redhat/eap7-wildfly-http-client<0:1.1.16-1.Final_redhat_00002.1.el8ea
0:1.1.16-1.Final_redhat_00002.1.el8ea
redhat/eap7-activemq-artemis-native<1:1.0.2-3.redhat_00004.1.el9ea
1:1.0.2-3.redhat_00004.1.el9ea
redhat/eap7-apache-mime4j<0:0.8.9-1.redhat_00001.1.el9ea
0:0.8.9-1.redhat_00001.1.el9ea
redhat/eap7-artemis-native<1:1.0.2-4.redhat_00004.1.el9ea
1:1.0.2-4.redhat_00004.1.el9ea
redhat/eap7-artemis-wildfly-integration<0:1.0.7-1.redhat_00001.1.el9ea
0:1.0.7-1.redhat_00001.1.el9ea
redhat/eap7-infinispan<0:11.0.17-1.Final_redhat_00001.1.el9ea
0:11.0.17-1.Final_redhat_00001.1.el9ea
redhat/eap7-ironjacamar<0:1.5.11-1.Final_redhat_00001.1.el9ea
0:1.5.11-1.Final_redhat_00001.1.el9ea
redhat/eap7-jboss-ejb-client<0:4.0.50-1.Final_redhat_00001.1.el9ea
0:4.0.50-1.Final_redhat_00001.1.el9ea
redhat/eap7-jboss-metadata<0:13.4.0-1.Final_redhat_00001.1.el9ea
0:13.4.0-1.Final_redhat_00001.1.el9ea
redhat/eap7-jboss-server-migration<0:1.10.0-26.Final_redhat_00025.1.el9ea
0:1.10.0-26.Final_redhat_00025.1.el9ea
redhat/eap7-jbossws-cxf<0:5.4.8-1.Final_redhat_00001.1.el9ea
0:5.4.8-1.Final_redhat_00001.1.el9ea
redhat/eap7-jbossws-spi<0:3.4.0-2.Final_redhat_00001.1.el9ea
0:3.4.0-2.Final_redhat_00001.1.el9ea
redhat/eap7-netty<0:4.1.86-1.Final_redhat_00001.1.el9ea
0:4.1.86-1.Final_redhat_00001.1.el9ea
redhat/eap7-netty-transport-native-epoll<0:4.1.86-1.Final_redhat_00001.1.el9ea
0:4.1.86-1.Final_redhat_00001.1.el9ea
redhat/eap7-picketlink-federation<0:2.5.5-22.SP12_redhat_00012.1.el9ea
0:2.5.5-22.SP12_redhat_00012.1.el9ea
redhat/eap7-resteasy<0:3.15.5-1.Final_redhat_00001.1.el9ea
0:3.15.5-1.Final_redhat_00001.1.el9ea
redhat/eap7-snakeyaml<0:1.33.0-2.SP1_redhat_00001.1.el9ea
0:1.33.0-2.SP1_redhat_00001.1.el9ea
redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el9ea
0:2.2.23-1.SP2_redhat_00001.1.el9ea
redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el9ea
0:2.0.14-1.Final_redhat_00001.1.el9ea
redhat/eap7-wildfly<0:7.4.10-6.GA_redhat_00002.1.el9ea
0:7.4.10-6.GA_redhat_00002.1.el9ea
redhat/eap7-wildfly-http-client<0:1.1.16-1.Final_redhat_00002.1.el9ea
0:1.1.16-1.Final_redhat_00002.1.el9ea
redhat/eap7-activemq-artemis-native<1:1.0.2-3.redhat_00004.1.el7ea
1:1.0.2-3.redhat_00004.1.el7ea
redhat/eap7-apache-mime4j<0:0.8.9-1.redhat_00001.1.el7ea
0:0.8.9-1.redhat_00001.1.el7ea
redhat/eap7-artemis-native<1:1.0.2-4.redhat_00004.1.el7ea
1:1.0.2-4.redhat_00004.1.el7ea
redhat/eap7-artemis-wildfly-integration<0:1.0.7-1.redhat_00001.1.el7ea
0:1.0.7-1.redhat_00001.1.el7ea
redhat/eap7-infinispan<0:11.0.17-1.Final_redhat_00001.1.el7ea
0:11.0.17-1.Final_redhat_00001.1.el7ea
redhat/eap7-ironjacamar<0:1.5.11-1.Final_redhat_00001.1.el7ea
0:1.5.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-ejb-client<0:4.0.50-1.Final_redhat_00001.1.el7ea
0:4.0.50-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-metadata<0:13.4.0-1.Final_redhat_00001.1.el7ea
0:13.4.0-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.10.0-26.Final_redhat_00025.1.el7ea
0:1.10.0-26.Final_redhat_00025.1.el7ea
redhat/eap7-jbossws-cxf<0:5.4.8-1.Final_redhat_00001.1.el7ea
0:5.4.8-1.Final_redhat_00001.1.el7ea
redhat/eap7-jbossws-spi<0:3.4.0-2.Final_redhat_00001.1.el7ea
0:3.4.0-2.Final_redhat_00001.1.el7ea
redhat/eap7-netty<0:4.1.86-1.Final_redhat_00001.1.el7ea
0:4.1.86-1.Final_redhat_00001.1.el7ea
redhat/eap7-netty-transport-native-epoll<0:4.1.86-1.Final_redhat_00001.1.el7ea
0:4.1.86-1.Final_redhat_00001.1.el7ea
redhat/eap7-picketlink-federation<0:2.5.5-22.SP12_redhat_00012.1.el7ea
0:2.5.5-22.SP12_redhat_00012.1.el7ea
redhat/eap7-resteasy<0:3.15.5-1.Final_redhat_00001.1.el7ea
0:3.15.5-1.Final_redhat_00001.1.el7ea
redhat/eap7-snakeyaml<0:1.33.0-2.SP1_redhat_00001.1.el7ea
0:1.33.0-2.SP1_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el7ea
0:2.2.23-1.SP2_redhat_00001.1.el7ea
redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el7ea
0:2.0.14-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly<0:7.4.10-6.GA_redhat_00002.1.el7ea
0:7.4.10-6.GA_redhat_00002.1.el7ea
redhat/eap7-wildfly-http-client<0:1.1.16-1.Final_redhat_00002.1.el7ea
0:1.1.16-1.Final_redhat_00002.1.el7ea
debian/hsqldb<=2.4.1-2
2.4.1-2+deb10u22.5.1-1+deb11u22.7.1-1+deb12u12.7.2-1
redhat/hsqldb<2.7.1
2.7.1
hsqldb HyperSQL DataBase<2.7.1
Debian Debian Linux=10.0
Debian Debian Linux=11.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/hsqldb to a version that resolves this vulnerability.

    Fixed in 1:1.8.0.10-13.el6_10
  2. Upgrade

    Upgrade redhat/hsqldb to a version that resolves this vulnerability.

    Fixed in 1:1.8.1.3-15.el7_9
  3. Upgrade

    Upgrade redhat/eap7-activemq-artemis-native to a version that resolves this vulnerability.

    Fixed in 1:1.0.2-3.redhat_00004.1.el8ea
  4. Upgrade

    Upgrade redhat/eap7-apache-mime4j to a version that resolves this vulnerability.

    Fixed in 0:0.8.9-1.redhat_00001.1.el8ea
  5. Upgrade

    Upgrade redhat/eap7-artemis-native to a version that resolves this vulnerability.

    Fixed in 1:1.0.2-4.redhat_00004.1.el8ea
  6. Upgrade

    Upgrade redhat/eap7-artemis-wildfly-integration to a version that resolves this vulnerability.

    Fixed in 0:1.0.7-1.redhat_00001.1.el8ea
  7. Upgrade

    Upgrade redhat/eap7-infinispan to a version that resolves this vulnerability.

    Fixed in 0:11.0.17-1.Final_redhat_00001.1.el8ea
  8. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.5.11-1.Final_redhat_00001.1.el8ea
  9. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.50-1.Final_redhat_00001.1.el8ea
  10. Upgrade

    Upgrade redhat/eap7-jboss-metadata to a version that resolves this vulnerability.

    Fixed in 0:13.4.0-1.Final_redhat_00001.1.el8ea
  11. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.10.0-26.Final_redhat_00025.1.el8ea
  12. Upgrade

    Upgrade redhat/eap7-jbossws-cxf to a version that resolves this vulnerability.

    Fixed in 0:5.4.8-1.Final_redhat_00001.1.el8ea
  13. Upgrade

    Upgrade redhat/eap7-jbossws-spi to a version that resolves this vulnerability.

    Fixed in 0:3.4.0-2.Final_redhat_00001.1.el8ea
  14. Upgrade

    Upgrade redhat/eap7-netty to a version that resolves this vulnerability.

    Fixed in 0:4.1.86-1.Final_redhat_00001.1.el8ea
  15. Upgrade

    Upgrade redhat/eap7-netty-transport-native-epoll to a version that resolves this vulnerability.

    Fixed in 0:4.1.86-1.Final_redhat_00001.1.el8ea
  16. Upgrade

    Upgrade redhat/eap7-picketlink-federation to a version that resolves this vulnerability.

    Fixed in 0:2.5.5-22.SP12_redhat_00012.1.el8ea
  17. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.15.5-1.Final_redhat_00001.1.el8ea
  18. Upgrade

    Upgrade redhat/eap7-snakeyaml to a version that resolves this vulnerability.

    Fixed in 0:1.33.0-2.SP1_redhat_00001.1.el8ea
  19. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.2.23-1.SP2_redhat_00001.1.el8ea
  20. Upgrade

    Upgrade redhat/eap7-undertow-jastow to a version that resolves this vulnerability.

    Fixed in 0:2.0.14-1.Final_redhat_00001.1.el8ea
  21. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.4.10-6.GA_redhat_00002.1.el8ea
  22. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.1.16-1.Final_redhat_00002.1.el8ea
  23. Upgrade

    Upgrade redhat/eap7-activemq-artemis-native to a version that resolves this vulnerability.

    Fixed in 1:1.0.2-3.redhat_00004.1.el9ea
  24. Upgrade

    Upgrade redhat/eap7-apache-mime4j to a version that resolves this vulnerability.

    Fixed in 0:0.8.9-1.redhat_00001.1.el9ea
  25. Upgrade

    Upgrade redhat/eap7-artemis-native to a version that resolves this vulnerability.

    Fixed in 1:1.0.2-4.redhat_00004.1.el9ea
  26. Upgrade

    Upgrade redhat/eap7-artemis-wildfly-integration to a version that resolves this vulnerability.

    Fixed in 0:1.0.7-1.redhat_00001.1.el9ea
  27. Upgrade

    Upgrade redhat/eap7-infinispan to a version that resolves this vulnerability.

    Fixed in 0:11.0.17-1.Final_redhat_00001.1.el9ea
  28. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.5.11-1.Final_redhat_00001.1.el9ea
  29. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.50-1.Final_redhat_00001.1.el9ea
  30. Upgrade

    Upgrade redhat/eap7-jboss-metadata to a version that resolves this vulnerability.

    Fixed in 0:13.4.0-1.Final_redhat_00001.1.el9ea
  31. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.10.0-26.Final_redhat_00025.1.el9ea
  32. Upgrade

    Upgrade redhat/eap7-jbossws-cxf to a version that resolves this vulnerability.

    Fixed in 0:5.4.8-1.Final_redhat_00001.1.el9ea
  33. Upgrade

    Upgrade redhat/eap7-jbossws-spi to a version that resolves this vulnerability.

    Fixed in 0:3.4.0-2.Final_redhat_00001.1.el9ea
  34. Upgrade

    Upgrade redhat/eap7-netty to a version that resolves this vulnerability.

    Fixed in 0:4.1.86-1.Final_redhat_00001.1.el9ea
  35. Upgrade

    Upgrade redhat/eap7-netty-transport-native-epoll to a version that resolves this vulnerability.

    Fixed in 0:4.1.86-1.Final_redhat_00001.1.el9ea
  36. Upgrade

    Upgrade redhat/eap7-picketlink-federation to a version that resolves this vulnerability.

    Fixed in 0:2.5.5-22.SP12_redhat_00012.1.el9ea
  37. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.15.5-1.Final_redhat_00001.1.el9ea
  38. Upgrade

    Upgrade redhat/eap7-snakeyaml to a version that resolves this vulnerability.

    Fixed in 0:1.33.0-2.SP1_redhat_00001.1.el9ea
  39. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.2.23-1.SP2_redhat_00001.1.el9ea
  40. Upgrade

    Upgrade redhat/eap7-undertow-jastow to a version that resolves this vulnerability.

    Fixed in 0:2.0.14-1.Final_redhat_00001.1.el9ea
  41. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.4.10-6.GA_redhat_00002.1.el9ea
  42. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.1.16-1.Final_redhat_00002.1.el9ea
  43. Upgrade

    Upgrade redhat/eap7-activemq-artemis-native to a version that resolves this vulnerability.

    Fixed in 1:1.0.2-3.redhat_00004.1.el7ea
  44. Upgrade

    Upgrade redhat/eap7-apache-mime4j to a version that resolves this vulnerability.

    Fixed in 0:0.8.9-1.redhat_00001.1.el7ea
  45. Upgrade

    Upgrade redhat/eap7-artemis-native to a version that resolves this vulnerability.

    Fixed in 1:1.0.2-4.redhat_00004.1.el7ea
  46. Upgrade

    Upgrade redhat/eap7-artemis-wildfly-integration to a version that resolves this vulnerability.

    Fixed in 0:1.0.7-1.redhat_00001.1.el7ea
  47. Upgrade

    Upgrade redhat/eap7-infinispan to a version that resolves this vulnerability.

    Fixed in 0:11.0.17-1.Final_redhat_00001.1.el7ea
  48. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.5.11-1.Final_redhat_00001.1.el7ea
  49. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.50-1.Final_redhat_00001.1.el7ea
  50. Upgrade

    Upgrade redhat/eap7-jboss-metadata to a version that resolves this vulnerability.

    Fixed in 0:13.4.0-1.Final_redhat_00001.1.el7ea
  51. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.10.0-26.Final_redhat_00025.1.el7ea
  52. Upgrade

    Upgrade redhat/eap7-jbossws-cxf to a version that resolves this vulnerability.

    Fixed in 0:5.4.8-1.Final_redhat_00001.1.el7ea
  53. Upgrade

    Upgrade redhat/eap7-jbossws-spi to a version that resolves this vulnerability.

    Fixed in 0:3.4.0-2.Final_redhat_00001.1.el7ea
  54. Upgrade

    Upgrade redhat/eap7-netty to a version that resolves this vulnerability.

    Fixed in 0:4.1.86-1.Final_redhat_00001.1.el7ea
  55. Upgrade

    Upgrade redhat/eap7-netty-transport-native-epoll to a version that resolves this vulnerability.

    Fixed in 0:4.1.86-1.Final_redhat_00001.1.el7ea
  56. Upgrade

    Upgrade redhat/eap7-picketlink-federation to a version that resolves this vulnerability.

    Fixed in 0:2.5.5-22.SP12_redhat_00012.1.el7ea
  57. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.15.5-1.Final_redhat_00001.1.el7ea
  58. Upgrade

    Upgrade redhat/eap7-snakeyaml to a version that resolves this vulnerability.

    Fixed in 0:1.33.0-2.SP1_redhat_00001.1.el7ea
  59. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.2.23-1.SP2_redhat_00001.1.el7ea
  60. Upgrade

    Upgrade redhat/eap7-undertow-jastow to a version that resolves this vulnerability.

    Fixed in 0:2.0.14-1.Final_redhat_00001.1.el7ea
  61. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.4.10-6.GA_redhat_00002.1.el7ea
  62. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.1.16-1.Final_redhat_00002.1.el7ea
  63. Upgrade

    Upgrade debian/hsqldb to a version that resolves this vulnerability.

    Fixed in 2.4.1-2+deb10u2Fixed in 2.5.1-1+deb11u2Fixed in 2.7.1-1+deb12u1Fixed in 2.7.2-1
  64. Upgrade

    Upgrade redhat/hsqldb to a version that resolves this vulnerability.

    Fixed in 2.7.1
  65. Upgrade

    Upgrade HSQLDB to a version that resolves this vulnerability.

    Fixed in 2.7.1
  66. Configuration

    Set the Java system property "hsqldb.method_class_names" to a semicolon-separated allowlist of classes to restrict which static methods/classes are callable (example: java -Dhsqldb.method_class_names="org.me.MyClass;org.you.YourClass;org.you.lib.*").

    HSQLDB hsqldb.method_class_names = org.me.MyClass;org.you.YourClass;org.you.lib.*

Event History

Oct 6, 2022
CVE Published
12:00 AM
CVE Published
via MITRE·05:14 PM
Data Sourced
via MITRE·05:14 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeaknessAffected Software
Oct 19, 2022
Data Sourced
via Red Hat·12:25 PM
DescriptionSeverityAffected Software
Nov 6, 2022
Data Sourced
08:24 PM
SeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2022-41853?

CVE-2022-41853 has a severity rating of high due to its potential for remote code execution.

2

How do I fix CVE-2022-41853?

To fix CVE-2022-41853, update hsqldb to the recommended versions provided by your operating system vendor, such as 1:1.8.0.10-13.el6_10 for Red Hat.

3

What vulnerability is associated with CVE-2022-41853?

CVE-2022-41853 is associated with the use of java.sql.Statement or java.sql.PreparedStatement in hsqldb, which can lead to remote code execution when processing untrusted input.

4

Which software versions are affected by CVE-2022-41853?

Affected software versions include hsqldb versions prior to 2.7.1 and several specific versions of eap7 packages.

5

How can I check if I'm vulnerable to CVE-2022-41853?

To check if you're vulnerable to CVE-2022-41853, verify the version of hsqldb or related packages in use and compare them against the fixed versions.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203