CVE-2018-10054: Improper Input Validation in Datomic
Summary
CVE-2018-10054: Improper Input Validation in Datomic. Affects com.datomic:datomic-free versions < 0.9.5697. Fixed in 0.9.5697. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Datomic is a database system that allows users to store, query, and analyze data. It is widely used in various applications and is available as a free package in the Maven ecosystem. Datomic versions before 0.9.5697 are affected by a vulnerability that allows for remote code execution. This vulnerability is due to improper input validation in H2 1.4.197, which is used by Datomic and other products. As a result, an attacker can exploit the CREATE ALIAS functionality to execute arbitrary Java code.
Vulnerability Detail
The vulnerability in Datomic arises from the improper input validation in H2 1.4.197. By leveraging the CREATE ALIAS feature, an attacker can inject and execute arbitrary Java code remotely. This can lead to various consequences, including unauthorized access, data manipulation, and potential compromise of the entire system. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Minimum fixed version
0.9.5697
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of Datomic as soon as possible to mitigate the risk of exploitation.
Conclusion
In conclusion, the vulnerability in Datomic (CVE-2018-10054) arises from improper input validation in H2 1.4.197. It allows for remote code execution, posing a significant risk to the security and integrity of affected systems. To mitigate this vulnerability, it is crucial to update Datomic to version 0.9.5697 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.datomic:datomic-free →
FAQ
Datomic is a database system that allows users to store, query, and analyze data. It provides a flexible and scalable solution for managing data in various applications.
The vulnerability allows for remote code execution, which can lead to unauthorized access, data manipulation, and potential compromise of the entire system.
To fix this vulnerability, update Datomic to version 0.9.5697 or later, which includes the necessary patches to address the issue.
No, there is no known workaround for this vulnerability. It is essential to update to the fixed version of Datomic.
The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
