Skip to content
Fencer Vulns
critical 9.8

CVE-2021-42392 in the critical feed json

RCE in H2 Console

published 2022-01-06 4 y ago modified 2026-07-08 4 mo ago also GHSA-h376-j262-vhq6 , EUVD-2022-0610

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
83.2%
EPSS 83.2% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known, plus a Nuclei check

Summary

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.

Patch / fix

  • maven com.h2database:h2 2.0.206
  • h2database Debian 14, Debian 13, Debian 12 2.1.210-1

debian advisories DEBIAN-CVE-2021-42392

  • h2database Ubuntu 20.04 LTS 1.4.197-4+deb10u1build0.20.04.1
  • h2database Ubuntu 22.04 LTS 2.1.210+really1.4.197-1
  • h2database Ubuntu Pro 16.04 LTS 1.4.191-1ubuntu0.1~esm1
  • h2database Ubuntu Pro 18.04 LTS 1.4.196-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2021-42392

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-netty jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.5-3.GA_redhat_00001.1.el7eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.17-2.SP4_redhat_00001.1.el7eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-xerces-j2 jboss enterprise application platform 7.4 2.12.0-3.SP04_redhat_00001.1.el7eap
  • eap7-h2database jboss enterprise application platform 7.4 1.4.197-2.redhat_00004.1.el7eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.12-1.Final_redhat_00001.1.el7eap
  • eap7-netty-codec jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap

red hat advisories RHSA-2025:1747RHSA-2022:4918RHSA-2022:4919RHSA-2022:7411RHSA-2022:7409RHSA-2022:7410

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-42392 updated cvss 9.8

h2: Remote Code Execution in Console

  • Red Hat BPM Suite 6 h2
    affected: no fix planned “Out of support scope”
  • Red Hat build of Apicurio Registry 2 h2 Red Hat Integration Camel Quarkus 1 h2
    affected: no fix available
  • Red Hat JBoss BRMS 5 h2 Red Hat JBoss BRMS 6 h2 Red Hat JBoss Data Grid 7 h2 Red Hat JBoss Data Virtualization 6 h2 Red Hat JBoss Enterprise Application Platform 6 h2 Red Hat JBoss Fuse 6 h2
    +3 more products
    Red Hat JBoss Fuse Service Works 6 h2 Red Hat JBoss Operations Network 3 h2 Red Hat JBoss SOA Platform 5 h2
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-presto
    affected: no fix planned “Will not fix”
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-h2database 1.4.197-2.redhat_00004.1.el7eap
    fixed: vendor fix RHSA-2022:4918
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-h2database 1.4.197-2.redhat_00004.1.el8eap
    fixed: vendor fix RHSA-2022:4919
  • Red Hat JBoss Enterprise Application Platform h2 1.4.197.redhat-00004
    fixed: vendor fix RHSA-2022:4922
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jettison 1.5.2-2.redhat_00002.1.el7eap, eap7-wildfly 7.3.12-3.GA_redhat_00002.1.el7eap, eap7-netty 4.1.63-4.Final_redhat_00002.1.el7eap, eap7-jackson-core 2.10.4-2.redhat_00004.1.el7eap, eap7-snakeyaml 1.33.0-1.SP1_redhat_00001.1.el7eap, eap7-resteasy 3.11.6-1.Final_redhat_00001.1.el7eap, +35 more
    fixed: vendor fix RHSA-2025:1747
show 9 more
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2022:6787
  • Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak 15.0.8-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 15.0.8-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2022:6782
  • Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak 15.0.8-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 15.0.8-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2022:6783
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.3-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2022:7409
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.3-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2022:7410
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7 1-5.el9sso, rh-sso7-runtime 1-5.el9sso, rh-sso7-javapackages-tools 6.0.0-7.el9sso, rh-sso7-python3-javapackages 6.0.0-7.el9sso, rh-sso7-javapackages-filesystem 6.0.0-7.el9sso, rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el9sso, +1 more
    fixed: vendor fix RHSA-2022:7411
  • Red Hat Single Sign-On 7.6.1
    fixed: vendor fix RHSA-2022:7417
  • Red Hat RHINT Camel-Q 2.2.1
    fixed: vendor fix RHSA-2022:1013
  • Red Hat Decision Manager 7 h2 Red Hat Fuse 7 h2 Red Hat Integration Camel K 1 h2 Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-log4j 2.17.1-2.redhat_00002.1.el7eap, eap7-jberet 1.3.9-1.SP1_redhat_00001.1.el7eap, eap7-snakeyaml 1.29.0-1.redhat_00001.2.el7eap, eap7-wildfly 7.4.5-3.GA_redhat_00001.1.el7eap, eap7-netty 4.1.72-4.Final_redhat_00001.1.el7eap, eap7-jackson-core 2.12.6-1.redhat_00001.1.el7eap, +84 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-log4j 2.17.1-2.redhat_00002.1.el8eap, eap7-jberet 1.3.9-1.SP1_redhat_00001.1.el8eap, eap7-snakeyaml 1.29.0-1.redhat_00001.2.el8eap, eap7-wildfly 7.4.5-3.GA_redhat_00001.1.el8eap, eap7-netty 4.1.72-4.Final_redhat_00001.1.el8eap, eap7-jackson-core 2.12.6-1.redhat_00001.1.el8eap, +82 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1482 more
    +2 more products
    Red Hat JBoss Enterprise Application Platform Expansion Pack h2 Red Hat Process Automation 7 h2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

83.18% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template H2 Database Console - JNDI Injection RCE nuclei detection template
  • jfrog.com https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven com.h2database:h2
>=1.1.100, <2.0.206
2.0.206

Affected products

  • h2database h2

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.