Deserialization of Untrusted Data in H2 Database - CVE-2021-42392

Vulnerability identifier: #VU61937

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-42392

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the org.h2.util.JdbcUtils.getConnection method. A remote attacker can pass a JNDI driver name and a URL leading to a LDAP or RMI servers and execute arbitrary code on the system.

H2 Database
Debian Linux
Ubuntu
Oracle Communications Cloud Native Core Policy
JBoss Enterprise Application Platform
Red Hat Single Sign-On
rh-sso7-keycloak (Red Hat package)
h2database (Debian package)
libh2-java (Ubuntu package)
rh-sso7 (Red Hat package)
eap7-jettison (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-netty (Red Hat package)
rh-sso7-javapackages-tools (Red Hat package)
eap7-wildfly (Red Hat package)

Install updates from vendor's website.

H2 Database - update to 2.0.206
JBoss Enterprise Application Platform - addressed in versions 7.3.12, 7.4.5
Red Hat Single Sign-On - addressed in versions 7.5.3, 7.6.1
rh-sso7-keycloak (Red Hat package) - addressed in versions 15.0.8-1.redhat_00001.1.el7sso, 15.0.8-1.redhat_00001.1.el8sso, 18.0.3-1.redhat_00001.1.el7sso, 18.0.3-1.redhat_00001.1.el8sso
h2database (Debian package) - addressed in versions 1.4.197-4+deb10u1, 1.4.197-4+deb11u1
libh2-java (Ubuntu package) - addressed in versions 1.4.197-4+deb10u1build0.20.04.1, 1.4.197-4+deb10u1build0.21.10.1
rh-sso7 (Red Hat package) - update to 1-5.el9sso
eap7-jettison (Red Hat package) - update to 1.5.2-2.redhat_00002.1.el7eap
eap7-snakeyaml (Red Hat package) - update to 1.33.0-1.SP1_redhat_00001.1.el7eap
eap7-jackson-modules-java8 (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-annotations (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-core (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-jaxrs-providers (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-modules-base (Red Hat package) - update to 2.10.4-4.redhat_00004.1.el7eap
eap7-jackson-databind (Red Hat package) - update to 2.10.4-4.redhat_00004.1.el7eap
eap7-hal-console (Red Hat package) - update to 3.2.17-1.Final_redhat_00001.1.el7eap
eap7-resteasy (Red Hat package) - update to 3.11.6-1.Final_redhat_00001.1.el7eap
eap7-netty (Red Hat package) - update to 4.1.63-4.Final_redhat_00002.1.el7eap
rh-sso7-javapackages-tools (Red Hat package) - update to 6.0.0-7.el9sso
eap7-wildfly (Red Hat package) - update to 7.3.12-3.GA_redhat_00002.1.el7eap

• Exploit #8126 - CVE-2021-42392-Detect () (July 10, 2022)

• https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6
• https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console/

• Remote code execution in H2 database
• Ubuntu update for h2database
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• Debian update for h2database
• Multiple vulnerabilities in Red Hat Single Sign-On 7.5
• Red Hat Single Sign-On 7.5 on RHEL 8 update for keycloak
• Red Hat Single Sign-On 7.5 on RHEL 7 update for keycloak
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7