CVE-2022-41853
Published on: Not Yet Published
Last Modified on: 02/03/2023 11:43:00 PM UTC
Certain versions of Debian Linux from Debian contain the following vulnerability:
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.
- CVE-2022-41853 has been assigned by
[email protected] to track the vulnerability - currently rated as CRITICAL severity. - Affected Vendor/Software: HyperSQL DataBase - hsqldb version < 2.7.1
CVSS3 Score: 9.8 - CRITICAL
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| Chapter 9. SQL-Invoked Routines | hsqldb.org text/html |
MISC hsqldb.org/doc/2.0/guide/sqlroutines-chapt.html#src_jrt_access_control |
| [SECURITY] [DLA 3234-1] hsqldb security update | lists.debian.org text/html |
MLIST [debian-lts-announce] 20221210 [SECURITY] [DLA 3234-1] hsqldb security update |
| Debian -- Security Information -- DSA-5313-1 hsqldb | www.debian.org Depreciated Link text/html |
DEBIAN DSA-5313 |
| 50212 - oss-fuzz - OSS-Fuzz: Fuzzing the planet - Monorail | bugs.chromium.org text/html |
MISC bugs.chromium.org/p/oss-fuzz/issues/detail?id=50212#c7 |
Related QID Numbers
- 160259 Oracle Enterprise Linux Security Update for hsqldb (ELSA-2022-8560)
- 181313 Debian Security Update for hsqldb (DLA 3234-1)
- 181466 Debian Security Update for hsqldb (DSA 5313-1)
- 240937 Red Hat Update for hsqldb (RHSA-2022:8560)
- 257204 CentOS Security Update for hsqldb (CESA-2022:8560)
- 354645 Amazon Linux Security Advisory for hsqldb : ALAS2-2023-1914
- 354681 Amazon Linux Security Advisory for hsqldb : ALAS-2023-1666
- 377795 Alibaba Cloud Linux Security Update for hsqldb (ALINUX2-SA-2022:0054)
- 752758 SUSE Enterprise Linux Security Update for hsqldb (SUSE-SU-2022:3864-1)
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 11.0 | All | All | All |
| Application | Hsqldb | Hypersql Database | All | All | All | All |
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*:
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*:
- cpe:2.3:a:hsqldb:hypersql_database:*:*:*:*:*:*:*:*:
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 /r/cybersecurity |
CVE-2022-41853: potential remote code execution vulnerability discovered in large Java database HSQLDB (CVSS Base Score 9.8) | 2022-10-19 18:10:13 |