Improper Input Validation in Datomic
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-10054US | high8.8 | Exploit | ||
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is… | ||||
02
references
External citations — patches, advisories, analysis.
- http://blog.datomic.com/2018/03/important-security-update.htmlWEB
- https://forum.datomic.com/t/important-security-update-0-9-5697/379WEB
- https://github.com/h2database/h2database/issues/1225WEB
- https://github.com/h2database/h2database/issues/1808#issuecomment-599203115WEB
- https://github.com/h2database/h2database/issues/3099WEB
- https://lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e%40%3Cuser.ignite.apache.org%3EWEB
- https://lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e@%3Cuser.ignite.apache.org%3EWEB
- https://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540%40%3Ccommits.nifi.apache.org%3EWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan