Vulnerability · Published Jan 7, 2022 · Assigned by JFROG
CVE-2021-42392
Critical 9.8
In plain English
A critical-severity unsafe deserialization in h2 from h2database. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 83.2% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | h2database | 2.1.210-1 | DEBIAN-CVE-2021-42392 |
| Debian:13 | h2database | 2.1.210-1 | DEBIAN-CVE-2021-42392 |
| Debian:14 | h2database | 2.1.210-1 | DEBIAN-CVE-2021-42392 |
| Maven | com.h2database:h2 | 2.0.206 | GHSA-h376-j262-vhq6 |
| Ubuntu:22.04:LTS | h2database | 2.1.210+really1.4.197-1 | UBUNTU-CVE-2021-42392 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| h2database | h2 | 1.1.000 – before * |
Weakness: CWE-502
References
- https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6
- [debian-lts-announce] 20220215 [SECURITY] [DLA 2923-1] h2database security update mailing-list
- DSA-5076 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console/
- https://security.netapp.com/advisory/ntap-20220119-0001/
- https://www.secpod.com/blog/log4shell-critical-remote-code-execution-vulnerability-in-h2database-console/