Skip to content
OpenAdvisories
Critical USN-5365-1 2 CVEs

h2database vulnerabilities

Published Apr 5, 2022 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that H2 was vulnerable to deserialization of
untrusted data. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2021-42392)

It was discovered that H2 incorrectly handled some specially
crafted connection URLs. An attacker could possibly use this
issue to execute arbitrary code. (CVE-2022-23221)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS h2database 1.4.197-4+deb10u1build0.20.04.1

Vulnerabilities 2

  • Critical 9.8
    CVE-2021-42392 Public exploit Scanner template EPSS 83%

    RCE in H2 Console

    The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This…

    h2database h2 com.h2database:h2 h2database Debian Ubuntu Maven
  • Critical 9.8
    CVE-2022-23221 Public exploit EPSS 65%

    Arbitrary code execution in H2 Console

    H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

    com.h2database:h2 h2database h2database Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2021-42392
  • report
    https://ubuntu.com/security/CVE-2022-23221