Update dependency com.h2database:h2 to v2 [SECURITY] #475
No reviewers
Labels
No labels
antville.org
bug
compatibility
dependency
duplicate
enhancement
help wanted
invalid
java
javascript
major
needs feedback
needs work
no-issue-activity
runtime
security
urgent
usability
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: antville/antville#475
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/maven-com.h2database-h2-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
1.4.200->2.2.220Improper Restriction of XML External Entity Reference in com.h2database:h2.
CVE-2021-23463 / GHSA-7rpj-hg47-cx62
More information
Details
H2 is an embeddable RDBMS written in Java. The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
RCE in H2 Console
CVE-2021-42392 / GHSA-h376-j262-vhq6
More information
Details
Impact
H2 Console in versions since 1.1.100 (2008-10-14) to 2.0.204 (2021-12-21) inclusive allows loading of custom classes from remote servers through JNDI.
H2 Console doesn't accept remote connections by default. If remote access was enabled explicitly and some protection method (such as security constraint) wasn't set, an intruder can load own custom class and execute its code in a process with H2 Console (H2 Server process or a web server with H2 Console servlet).
It is also possible to load them by creation a linked table in these versions, but it requires
ADMINprivileges and user withADMINprivileges has full access to the Java process by design. These privileges should never be granted to untrusted users.Patches
Since version 2.0.206 H2 Console and linked tables explicitly forbid attempts to specify LDAP URLs for JNDI. Only local data sources can be used.
Workarounds
H2 Console should never be available to untrusted users.
-webAllowOthersis a dangerous setting that should be avoided.H2 Console Servlet deployed on a web server can be protected with a security constraint:
https://h2database.com/html/tutorial.html#usingH2ConsoleServlet
If
webAllowOthersis specified, you need to uncomment and edit<security-role>and<security-constraint>as necessary. See documentation of your web server for more details.References
This issue was found and privately reported to H2 team by JFrog Security's vulnerability research team with detailed information.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Arbitrary code execution in H2 Console
CVE-2022-23221 / GHSA-45hx-wfhj-473x
More information
Details
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Password exposure in H2 Database
CVE-2022-45868 / GHSA-22wj-vf5f-wrvj
More information
Details
The web-based admin console in H2 Database Engine through 2.1.214 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that."
Severity
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
1a7f847f85to36489e6955Copied from https://github.com/antville/antville/pull/309#issuecomment-991704185:
In version 2 of H2
valueis a reserved keyword. Thus, thepostgre.sqlscript fails to create themetadatatable when running./gradlew :antclick:build.While this can be worked around by wrapping the keyword in quotes (
"value"), it still causes problems in subsequent SQL statements because Helma still tries to access the column without quotes.Renaming the column and adding an updater script for existing databases seems to be a better solution.
Update dependency com.h2database:h2 to v2 [SECURITY]to WIP: Update dependency com.h2database:h2 to v2 [SECURITY]36489e6955to16041aecda16041aecdatod085c0b0efd085c0b0efto0d0a357ea50d0a357ea5tod83f2d6cdad83f2d6cdato6ef29c8f226ef29c8f22toc98d67c4dbWIP: Update dependency com.h2database:h2 to v2 [SECURITY]to Update dependency com.h2database:h2 to v2 [SECURITY]c98d67c4dbto268af94c97268af94c97to7f330e9e347f330e9e34to4d0e49c6674d0e49c667to5b7a86bc9d5b7a86bc9dto4958ceab1c4958ceab1ctod594d00d7ad594d00d7ato81098fc91c81098fc91ctof1bfe232f3f1bfe232f3tod5dcd45ff4d5dcd45ff4toff97bd12efff97bd12efto9733a4d5ba9733a4d5batodc37ff236adc37ff236atob5ebf674e3b5ebf674e3to00e510420700e5104207to22013f2267Found the compatibility setting
non_keywordsthat should be good enough for AntClick:Added the string to the JDBC URLs accordingly in
67573db0e0.