Vulnerability Description
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| H2Database | H2 | >= 1.1.000, <= 2.0.204 |
| Debian | Debian Linux | 9.0 |
| Oracle | Communications Cloud Native Core Policy | 1.15.0 |
Related Weaknesses (CWE)
References
- https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6MitigationThird Party Advisory
- https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-ExploitTechnical DescriptionVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/02/msg00017.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20220119-0001/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5076Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.secpod.com/blog/log4shell-critical-remote-code-execution-vulnerabili
- https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6MitigationThird Party Advisory
- https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-ExploitTechnical DescriptionVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/02/msg00017.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20220119-0001/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5076Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.secpod.com/blog/log4shell-critical-remote-code-execution-vulnerabili
FAQ
What is CVE-2021-42392?
CVE-2021-42392 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to...
How severe is CVE-2021-42392?
CVE-2021-42392 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-42392?
Check the references section above for vendor advisories and patch information. Affected products include: H2Database H2, Debian Debian Linux, Oracle Communications Cloud Native Core Policy.