Vulnerability · Published Nov 23, 2022 · Assigned by mitre
CVE-2022-45868
High 8.4
In plain English
A high-severity security flaw in the h2database package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | h2database | no fix listed | DEBIAN-CVE-2022-45868 |
| Debian:13 | h2database | no fix listed | DEBIAN-CVE-2022-45868 |
| Debian:14 | h2database | no fix listed | DEBIAN-CVE-2022-45868 |
| Maven | com.h2database:h2 | 2.2.220 | GHSA-22wj-vf5f-wrvj |
Affected products (as reported)
References
- https://sites.google.com/sonatype.com/vulnerabilities/sonatype-2022-6243
- https://github.com/h2database/h2database/blob/96832bf5a97cdc0adc1f2066ed61c54990d66ab5/h2/src/main/org/h2/server/web/WebServer.java#L346-L347
- https://github.com/h2database/h2database/issues/3686
- https://github.com/advisories/GHSA-22wj-vf5f-wrvj
- https://github.com/h2database/h2database/pull/3833
- https://github.com/h2database/h2database/releases/tag/version-2.2.220