Remote Code Execution Vulnerability in H2Database: CVE-2021-42392
Summary
DEBIAN-CVE-2021-42392: The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. Affects h2database versions < 1.4.197-4+deb11u1. Fixed in 1.4.197-4+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
H2Database is a popular open-source relational database management system written in Java. It is known for its lightweight nature, ease of use, and ability to run in embedded or server modes. The database supports various features like in-memory databases, JDBC API, and SQL compatibility. However, it has been identified to have a critical vulnerability that allows remote code execution, posing a significant risk to applications that utilize it.
Vulnerability Detail
The vulnerability, identified as CVE-2021-42392, arises from the org.h2.util.JdbcUtils.getConnection method, which accepts a driver class name and a database URL. An attacker can exploit this by providing a JNDI driver name and a URL that points to an LDAP or RMI server, enabling remote code execution. This vulnerability can be exploited through various attack vectors, particularly through the H2 Console, leading to unauthenticated remote code execution. The potential ramifications include unauthorized access to sensitive data, system compromise, and the ability to execute arbitrary code on the server.
How To Fix
Minimum fixed version
1.4.197-4+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade h2databaseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the H2 Console or restricting access to it to trusted users only. Additionally, avoid using JNDI driver names and URLs that could lead to external servers.
Conclusion
CVE-2021-42392 represents a serious security risk for applications using H2Database. It is essential to update to the latest patched versions to protect against potential exploits. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in your software.
See every vulnerability recorded for h2database →
FAQ
CVE-2021-42392 is a vulnerability in H2Database that allows remote code execution through the JdbcUtils.getConnection method.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your manifest file.
The risks include unauthorized access to sensitive data, system compromise, and execution of arbitrary code on the server.
Yes, patches are available for various Debian versions. Ensure you update to the specified patched versions to mitigate the risk.
If immediate updates are not possible, consider disabling the H2 Console and restricting access to it as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for h2database.
