crítica
CVE-2022-23221
h2: Loading of custom classes from remote servers through JNDI
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta), Ubuntu (media).
Descripción
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.h2database:h2 | 2.1.210 |
| debian 10 | h2database | 1.4.197-4+deb10u1 |
| debian 11 | h2database | 1.4.197-4+deb11u1 |
| debian 12 | h2database | 2.1.210-1 |
| debian 13 | h2database | 2.1.210-1 |
| debian 14 | h2database | 2.1.210-1 |
| debian 9 | h2database | 1.4.193-1+deb9u1 |
| echo | h2database | 2.1.210-1 |
| seal maven::Seal Security Database | com.h2database:h2, seal.sp1.com.h2database:h2 | 1.4.196+sp999 |
| ubuntu 16.04-ESM | h2database | 1.4.191-1ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | h2database | 1.4.196-2ubuntu0.1~esm1 |
| ubuntu 20.04 | h2database | 1.4.197-4+deb10u1build0.20.04.1 |
Mostrar las 16 entradas de 15 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.h2database:h2 | 2.1.210 |
| debian 10 | h2database | 1.4.197-4+deb10u1 |
| debian 11 | h2database | 1.4.197-4+deb11u1 |
| debian 12 | h2database | 2.1.210-1 |
| debian 13 | h2database | 2.1.210-1 |
| debian 14 | h2database | 2.1.210-1 |
| debian 9 | h2database | 1.4.193-1+deb9u1 |
| echo | h2database | 2.1.210-1 |
| seal maven::Seal Security Database | com.h2database:h2 | 1.4.196+sp999 |
| seal maven::Seal Security Database | seal.sp1.com.h2database:h2 | 1.4.196+sp999 |
| ubuntu 16.04-ESM | h2database | 1.4.191-1ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | h2database | 1.4.196-2ubuntu0.1~esm1 |
| ubuntu 20.04 | h2database | 1.4.197-4+deb10u1build0.20.04.1 |
| ubuntu 20.04-ESM | h2database | 1.4.197-4+deb10u1build0.20.04.1 |
| ubuntu 21.10 | h2database | 1.4.197-4+deb10u1build0.21.10.1 |
| ubuntu 22.04 | h2database | 2.1.210+really1.4.197-1 |
Referencias
- http://packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2022/Jan/39
- https://access.redhat.com/security/cve/CVE-2022-23221
- https://github.com/advisories/GHSA-45hx-wfhj-473x
- https://github.com/h2database/h2database
- https://github.com/h2database/h2database/releases/tag/version-2.1.210
- https://github.com/h2database/h2database/security/advisories
- https://lists.debian.org/debian-lts-announce/2022/02/msg00017.html
Las 18 referencias
- https://nvd.nist.gov/vuln/detail/CVE-2022-23221
- https://security.netapp.com/advisory/ntap-20230818-0011
- https://security.netapp.com/advisory/ntap-20230818-0011/
- https://twitter.com/d0nkey_man/status/1483824727936450564
- https://ubuntu.com/security/notices/USN-5365-1
- https://ubuntu.com/security/notices/USN-6834-1
- https://www.cve.org/CVERecord?id=CVE-2022-23221
- https://www.debian.org/security/2022/dsa-5076
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html