com.h2database:h2@1.3.164 vulnerabilities

com.h2database:h2 is a database engine

Affected versions of this package are vulnerable to Insecure Permissions in the backup function which allows attackers to read sensitive files (out of their permissions scope) via a symlink to a fake database file.

Note: This is exploitable only if users misconfigured applications with excessive permissions. The documentation of H2 contains all necessary warnings for insecure configuration options and suggests security constraints for H2 Console servlet.

According to the above, this is a low severity vulnerability because of the low likelihood of it being exploited.

Upgrade com.h2database:h2 to version 1.4.198 or higher.

com.h2database:h2 is a database engine

Affected versions of this package are vulnerable to Remote Code Execution (RCE) via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring.

Upgrade com.h2database:h2 to version 2.1.210 or higher.

com.h2database:h2 is a database engine

Affected versions of this package are vulnerable to Remote Code Execution (RCE). H2 Console allows loading of custom classes from remote servers through JNDI. This can lead to code execution

If remote access was enabled explicitly and some protection method (such as security constraint) are not set, an intruder can load their own custom class and execute their code in a process using H2 Console (a H2 Server process or a web server with H2 Console servlet).

Note: It should be noted that H2 Console doesn't accept remote connections by default.

Workarounds

• H2 Console should never be available to untrusted users.

• -webAllowOthers is a dangerous setting that should be avoided.

• H2 Console Servlet deployed on a web server can be protected with a security constraint: https://h2database.com/html/tutorial.html#usingH2ConsoleServlet If webAllowOthers is specified, you need to uncomment and edit and as necessary. See documentation of your web server for more details.

All these workaround are mitigatory and unlikely to prevent all attack vectors, upgrade to a fixed version for full remediation.

Upgrade com.h2database:h2 to version 2.0.206 or higher.

com.h2database:h2 is a database engine

Affected versions of this package are vulnerable to Remote Code Execution (RCE). It provides a web console for managing the database, and by default it does not have a password set. The CREATE ALIAS function calls Java code, allowing an attacker to execute arbitrary Java code on projects running the h2 database.

NOTE: To be remotely exploitable, the affected application must be configured with the non-default setting webAllowOthers=true, either in a config file or as a parameter passed in when the servlet is invoked. The vulnerability can be avoided by setting a password on the database and/or restricting access to localhost using the above setting.

There is no fixed version for com.h2database:h2.