PT-2022-26099 · Hsqldb+4 · Hsqldb+4

Published 2022-06-10 · Updated 2023-12-22 · CVE-2022-41853

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions hsqldb versions prior to 2.7.1

Description The issue affects those using java.sql.Statement or java.sql.PreparedStatement in hsqldb to process untrusted input, making them vulnerable to a remote code execution attack. By default, it is allowed to call any static method of any Java class in the classpath, resulting in code execution.

Recommendations For versions prior to 2.7.1, update to 2.7.1 or set the system property hsqldb.method class names to classes which are allowed to be called, for example, by using System.setProperty("hsqldb.method class names", "abc") or Java argument -Dhsqldb.method class names="abc".

Fix

RCE

Weakness Enumeration

CWE-470

Related Identifiers

BDU:2026-01710

CESA-2022_8560

CVE-2022-41853

DLA-3234-1

DSA-5313-1

GHSA-77XX-RXVH-Q682

OESA-2023-1924

OESA-2023-1944

OPENSUSE-SU-2022_3823-1

OPENSUSE-SU-2024:12450-1

RHSA-2022:8559

RHSA-2022:8560

RHSA-2022_8559

RHSA-2022_8560

RHSA-2023:1512

RHSA-2023:1513

RHSA-2023:1514

RHSA-2024:10207

RHSA-2024:10208

SUSE-SU-2022:3823-1

SUSE-SU-2022:3864-1

SUSE-SU-2022_3864-1

Affected Products

Astra Linux

Centos

Red Hat

Suse

Hsqldb

References · 32

• https://ubuntu.com/security/CVE-2022-41853 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01710 · Security Note
• https://debian.org/security/2023/dsa-5313 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1924 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41853 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-8560.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-12103.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3823-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-41853 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41853 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:3864-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41853 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-41853 · Security Note
• https://osv.dev/vulnerability/DLA-3234-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77xx-rxvh-q682 · Vendor Advisory