Bug 2044596 (CVE-2022-23221)

Summary:	CVE-2022-23221 h2: Loading of custom classes from remote servers through JNDI
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aboyko, aileenc, akoufoud, alazarot, anstephe, asoldano, atangrin, bbaranow, bibryam, bmaxwell, bmontgom, boliveir, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, drieden, eleandro, eparis, eric.wittmann, etirelli, fjuma, gmalinko, hbraun, ibek, iweiss, janstey, jburrell, jnethert, jochrist, jokerman, jolee, jpallich, jperkins, jrokos, jschatte, jstastny, jwon, krathod, kverlaen, kwills, lgao, loleary, mnovotny, msochure, msvehla, nstielau, nwallace, pantinor, pdelbell, pdrozd, pjindal, pmackay, rguimara, rrajasek, rstancel, rsvoboda, smaestri, spinder, sponnaga, sthorger, theute, tom.jenkinson, tzimanyi, vkumar, yborgess
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	h2 2.1.210	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-06-06 19:19:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2044597

Description Pedro Sampaio 2022-01-24 19:46:11 UTC

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

https://github.com/h2database/h2database/security/advisories
https://github.com/h2database/h2database/releases/tag/version-2.1.210
https://twitter.com/d0nkey_man/status/1483824727936450564

Comment 16 errata-xmlrpc 2022-06-06 15:11:56 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2022:4922 https://access.redhat.com/errata/RHSA-2022:4922

Comment 17 errata-xmlrpc 2022-06-06 15:52:12 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2022:4918 https://access.redhat.com/errata/RHSA-2022:4918

Comment 18 errata-xmlrpc 2022-06-06 15:58:34 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2022:4919 https://access.redhat.com/errata/RHSA-2022:4919

Comment 19 Product Security DevOps Team 2022-06-06 19:19:37 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-23221

Comment 20 errata-xmlrpc 2022-07-07 14:21:56 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532