[jira] [Assigned] (HIVE-26566) Upgrade H2 database version to 2.1.214

[Naveen Gangam (Jira)]

 [ 
https://issues.apache.org/jira/browse/HIVE-26566?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Naveen Gangam reassigned HIVE-26566:


Assignee: Naveen Gangam  (was: Stamatis Zampetakis)

> Upgrade H2 database version to 2.1.214
> --
>
> Key: HIVE-26566
> URL: https://issues.apache.org/jira/browse/HIVE-26566
> Project: Hive
>  Issue Type: Task
>  Components: Testing Infrastructure
>Reporter: Stamatis Zampetakis
>Assignee: Naveen Gangam
>Priority: Minor
>  Labels: pull-request-available
> Fix For: 4.0.0, 4.0.0-alpha-1
>
>
> CVE-2021-23463 (CRITICAL severity) - The package com.h2database:h2 from 
> 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) 
> Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives 
> parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it 
> executes the getSource() method when the parameter is DOMSource.class it will 
> trigger the vulnerability.
> CVE-2021-42392 (CRITICAL severity) - The org.h2.util.JdbcUtils.getConnection 
> method of the H2 database takes as parameters the class name of the driver 
> and URL of the database. An attacker may pass a JNDI driver name and a URL 
> leading to a LDAP or RMI servers, causing remote code execution. This can be 
> exploited through various attack vectors, most notably through the H2 Console 
> which leads to unauthenticated remote code execution.
> CVE-2022-23221 (CRITICAL severity) - H2 Console before 2.1.210 allows remote 
> attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the 
> IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, 
> a different vulnerability than CVE-2021-42392.
> these have been addressed in 2.1.214



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

[jira] [Assigned] (HIVE-26566) Upgrade H2 database version to 2.1.214

[Naveen Gangam (Jira)]

 [ 
https://issues.apache.org/jira/browse/HIVE-26566?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Naveen Gangam reassigned HIVE-26566:



> Upgrade H2 database version to 2.1.214
> --
>
> Key: HIVE-26566
> URL: https://issues.apache.org/jira/browse/HIVE-26566
> Project: Hive
>  Issue Type: Task
>  Components: Testing Infrastructure
>Reporter: Stamatis Zampetakis
>Assignee: Stamatis Zampetakis
>Priority: Minor
>  Labels: pull-request-available
> Fix For: 4.0.0, 4.0.0-alpha-1
>
>
> The 1.3.166 version, which is in use in Hive, suffers from the following 
> security vulnerabilities:
> https://nvd.nist.gov/vuln/detail/CVE-2021-42392
> https://nvd.nist.gov/vuln/detail/CVE-2022-23221
> In the project, we use H2 only for testing purposes (inside the jdbc-handler 
> module) thus the H2 binaries are not present in the runtime classpath thus 
> these CVEs do not pose a problem for Hive or its users. Nevertheless, it 
> would be good to upgrade to a more recent version to avoid Hive coming up in 
> vulnerability scans due to this.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)