CVE-2022-41853

Katalog CVE

CVSS 9.8 · Critical EPSS 5,1%

Kerentanan Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') pada hsqldb hypersql database, debian linux. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.

Rincian

Terbit di NVD

6 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

EPSS (30 hari)

5,1% peluang dieksploitasi; lebih tinggi dari 92,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://hsqldb.org/doc/2.0/guide/sqlroutines-chapt.html#src_jrt_access_control advisory pihak ketiga
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50212#c7 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/12/msg00020.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5313 advisory pihak ketiga