Fluid Attacks Database

Description

Improper Input Validation in Datomic H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
maven	com.datomic:datomic-free	>=0 <0.9.5697	0.9.5697

Aliases

1. CVE-2018-100542. NVD-2018-100543. OSV-2018-100544. GCVE-2018-10054

References

1. https://github.com/h2database/h2database/issues/12252. https://github.com/h2database/h2database/issues/1808#issuecomment-5992031153. https://github.com/h2database/h2database/issues/30994. https://forum.datomic.com/t/important-security-update-0-9-5697/3795. https://lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e%40%3Cuser.ignite.apache.org%3E6. https://lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e@%3Cuser.ignite.apache.org%3E7. https://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540%40%3Ccommits.nifi.apache.org%3E8. https://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540@%3Ccommits.nifi.apache.org%3E9. https://mthbernardes.github.io/rce/2018/03/14/abusing-h2-database-alias.html10. https://security.netapp.com/advisory/ntap-20240719-000311. https://www.exploit-db.com/exploits/4442212. http://blog.datomic.com/2018/03/important-security-update.html13. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/h2_webinterface_rce.rb