CVE-2018-10054

Published: Apr 11, 2018

Modified: Aug 5, 2024

PUBLISHED

Description

H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is "h2 is not designed to be run outside of a secure environment."

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://forum.datomic.com/t/important-security-update-0-9-5697/379

44422

exploit

http://blog.datomic.com/2018/03/important-security-update.html

https://mthbernardes.github.io/rce/2018/03/14/abusing-h2-database-alias.html

[ignite-user] 20191213 Re: H2 version security concern

mailing-list

[nifi-commits] 20200421 svn commit: r1876802 - /nifi/site/trunk/registry-security.html

mailing-list

https://github.com/h2database/h2database/issues/1225

https://github.com/h2database/h2database/issues/3099

https://github.com/h2database/h2database/issues/1808#issuecomment-599203115

https://security.netapp.com/advisory/ntap-20240719-0003/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2018-10054

Description

Affected Products

References