Vulnerability · Published Jan 19, 2022 · Assigned by mitre
CVE-2022-23221
Critical 9.8
In plain English
A critical-severity argument injection in the h2database package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 64.8% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | h2database | 2.1.210-1 | DEBIAN-CVE-2022-23221 |
| Debian:13 | h2database | 2.1.210-1 | DEBIAN-CVE-2022-23221 |
| Debian:14 | h2database | 2.1.210-1 | DEBIAN-CVE-2022-23221 |
| Maven | com.h2database:h2 | 2.1.210 | GHSA-45hx-wfhj-473x |
| Ubuntu:22.04:LTS | h2database | 2.1.210+really1.4.197-1 | UBUNTU-CVE-2022-23221 |
Affected products (as reported)
Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/h2database/h2database/security/advisories
- 20220124 Unauthenticated RCE vuln in the H2 Database console: CVE-2022-23221. mailing-list
- [debian-lts-announce] 20220215 [SECURITY] [DLA 2923-1] h2database security update mailing-list
- DSA-5076 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/h2database/h2database/releases/tag/version-2.1.210
- https://twitter.com/d0nkey_man/status/1483824727936450564
- http://packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20230818-0011/