Lucene search

GitHub Advisory DatabaseGHSA-9PF8-QQHM-7W64

HistoryMay 13, 2022 - 1:30 a.m.

Improper Input Validation in Datomic

2022-05-1301:30:17

CWE-20

GitHub Advisory Database

github.com

datomic

input validation

h2 1.4.197

remote code execution

java code

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.26

Percentile

96.8%

JSON

H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code.

Affected configurations

Vulners

Node

com.datomicdatomic-freeRange≤0.9.5656

VendorProductVersionCPE
com.datomicdatomic-free*cpe:2.3:a:com.datomic:datomic-free:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
com.datomic	datomic-free	*	cpe:2.3:a:com.datomic:datomic-free::::::::

References

blog.datomic.com/2018/03/important-security-update.html

forum.datomic.com/t/important-security-update-0-9-5697/379

github.com/advisories/GHSA-9pf8-qqhm-7w64

github.com/h2database/h2database/issues/1225

github.com/h2database/h2database/issues/1808#issuecomment-599203115

github.com/h2database/h2database/issues/3099

lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e%40%3Cuser.ignite.apache.org%3E

lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e@%3Cuser.ignite.apache.org%3E

lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540%40%3Ccommits.nifi.apache.org%3E

lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540@%3Ccommits.nifi.apache.org%3E

mthbernardes.github.io/rce/2018/03/14/abusing-h2-database-alias.html

nvd.nist.gov/vuln/detail/CVE-2018-10054

security.netapp.com/advisory/ntap-20240719-0003

www.exploit-db.com/exploits/44422

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.26

Percentile

96.8%

JSON

Related for GHSA-9PF8-QQHM-7W64