An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Name | Vendor | Start Version | End Version |
---|---|---|---|
H2 | H2database | 1.4.197 (including) | 1.4.197 (including) |
Red Hat Data Grid 7.3.3 | RedHat | h2 | * |
H2database | Ubuntu | bionic | * |
H2database | Ubuntu | cosmic | * |
H2database | Ubuntu | disco | * |
H2database | Ubuntu | eoan | * |
H2database | Ubuntu | esm-apps/bionic | * |
H2database | Ubuntu | esm-apps/focal | * |
H2database | Ubuntu | esm-apps/xenial | * |
H2database | Ubuntu | focal | * |
H2database | Ubuntu | groovy | * |
H2database | Ubuntu | hirsute | * |
H2database | Ubuntu | impish | * |
H2database | Ubuntu | kinetic | * |
H2database | Ubuntu | lunar | * |
H2database | Ubuntu | xenial | * |