Vulnerability · Published Oct 6, 2022 · Assigned by Google
CVE-2022-41853Remote code execution in HyperSQL DataBase
High 8.0
In plain English
A high-severity security flaw in hsqldb from HyperSQL DataBase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.1% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | hsqldb | 2.7.1-1 | DEBIAN-CVE-2022-41853 |
| Debian:13 | hsqldb | 2.7.1-1 | DEBIAN-CVE-2022-41853 |
| Debian:14 | hsqldb | 2.7.1-1 | DEBIAN-CVE-2022-41853 |
| Maven | org.hsqldb:hsqldb | 2.7.1 | GHSA-77xx-rxvh-q682 |
| Ubuntu:22.04:LTS | hsqldb | no fix listed | UBUNTU-CVE-2022-41853 |
| Ubuntu:24.04:LTS | hsqldb | no fix listed | UBUNTU-CVE-2022-41853 |
| Ubuntu:25.10 | hsqldb | no fix listed | UBUNTU-CVE-2022-41853 |
| Ubuntu:26.04:LTS | hsqldb | no fix listed | UBUNTU-CVE-2022-41853 |
| Ubuntu:26.10 | hsqldb | no fix listed | UBUNTU-CVE-2022-41853 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HyperSQL DataBase | hsqldb | unspecified – before 2.7.1 |
Weakness: CWE-470 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H