CVE-2022-41853 Remote code execution in HyperSQL DataBase
Attackers can execute arbitrary code via SQL statements in HyperSQL database due to unrestricted static method calls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-41853?
CVE-2022-41853 is a high-severity code injection vulnerability in Debian Debian Linux, published on 6 Oct 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.
Weakness: CWE-470
Which versions are affected by CVE-2022-41853?
2 open source packages ship an affected version, including org.hsqldb:hsqldb. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.hsqldb:hsqldb Maven | All versions | 2.7.1 |
org.hsqldb:hsqldb Maven | All versions | 2.7.1 |
Linux distribution packages (23)
hsqldb Red Hat:enterprise_linux:7::client | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-demo Red Hat:enterprise_linux:7::client | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-javadoc Red Hat:enterprise_linux:7::client | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-manual Red Hat:enterprise_linux:7::client | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-demo Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-javadoc Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-manual Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb Red Hat:enterprise_linux:7::server | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-demo Red Hat:enterprise_linux:7::server | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-javadoc Red Hat:enterprise_linux:7::server | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-manual Red Hat:enterprise_linux:7::server | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb Red Hat:enterprise_linux:7::workstation | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-demo Red Hat:enterprise_linux:7::workstation | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-javadoc Red Hat:enterprise_linux:7::workstation | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb-manual Red Hat:enterprise_linux:7::workstation | All versions | 1:1.8.1.3-15.el7_9 |
hsqldb Red Hat:rhel_els:6 | All versions | 1:1.8.0.10-13.el6_10 |
hsqldb-demo Red Hat:rhel_els:6 | All versions | 1:1.8.0.10-13.el6_10 |
hsqldb-javadoc Red Hat:rhel_els:6 | All versions | 1:1.8.0.10-13.el6_10 |
hsqldb-manual Red Hat:rhel_els:6 | All versions | 1:1.8.0.10-13.el6_10 |
hsqldb SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 2.2.9-5.3.1 |
hsqldb openSUSE:Leap 15.3 | All versions | 2.3.3-150000.7.3.1 |
hsqldb openSUSE:Leap 15.4 | All versions | 2.3.3-150000.7.3.1 |
Products include Debian Debian Linux, Hsqldb Hypersql Database.
How do I fix CVE-2022-41853?
Upgrade org.hsqldb:hsqldb to 2.7.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-41853 being exploited?
There is no known exploitation of CVE-2022-41853 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2026-VM57227, DEBIAN-CVE-2022-41853, DLA-3234-1, DSA-5313-1, GHSA-77xx-rxvh-q682, OESA-2023-1924 and 7 more.