Skip to content
OpenAdvisories
Critical DSA-5076-1 2 CVEs

h2database - security update

Published Feb 15, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 10 h2database 1.4.197-4+deb10u1
Debian · 11 h2database 1.4.197-4+deb11u1

Vulnerabilities 2

  • Critical 9.8
    CVE-2021-42392 Public exploit Scanner template EPSS 83%

    RCE in H2 Console

    The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This…

    h2database h2 com.h2database:h2 h2database Debian Ubuntu Maven
  • Critical 9.8
    CVE-2022-23221 Public exploit EPSS 65%

    Arbitrary code execution in H2 Console

    H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

    com.h2database:h2 h2database h2database Debian Ubuntu Maven