Skip to content
Fencer Intel
high 8.0

CVE-2022-41853 json

Remote code execution in HyperSQL DataBase

published 4y ago modified 4mo ago also GHSA-77xx-rxvh-q682 , EUVD-2022-7043

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
5.1%
EPSS 5.1% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.

Patch / fix

  • maven org.hsqldb:hsqldb 2.7.1
  • HyperSQL DataBase hsqldb 2.7.1
  • hsqldb Debian 14, Debian 13, Debian 12 2.7.1-1

debian advisories DEBIAN-CVE-2022-41853

  • eap7-netty jboss enterprise application platform 7.4 4.1.86-1.Final_redhat_00001.1.el9eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.10-6.GA_redhat_00002.1.el9eap
  • eap7-resteasy jboss enterprise application platform 7.4 3.15.5-1.Final_redhat_00001.1.el9eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.23-1.SP2_redhat_00001.1.el9eap
  • eap7-snakeyaml jboss enterprise application platform 7.4 1.33.0-2.SP1_redhat_00001.1.el9eap
  • eap7-infinispan jboss enterprise application platform 7.4 11.0.17-1.Final_redhat_00001.1.el9eap
  • eap7-ironjacamar jboss enterprise application platform 7.4 1.5.11-1.Final_redhat_00001.1.el9eap
  • eap7-jbossws-cxf jboss enterprise application platform 7.4 5.4.8-1.Final_redhat_00001.1.el9eap

red hat advisories RHSA-2024:10208RHSA-2024:10207RHSA-2023:1514RHSA-2023:1513RHSA-2023:1512RHSA-2022:8560

  • hsqldb SLE Software Development Kit 12 SP5 2.2.9-5.3.1
  • hsqldb openSUSE Leap 15.4, openSUSE Leap 15.3 2.3.3-150000.7.3.1

suse advisories SUSE-SU-2022:3864-1SUSE-SU-2022:3823-1

Is CVE-2022-41853 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-41853 updated cvss 9.8

hsqldb: Untrusted input may lead to RCE attack

  • Red Hat Data Grid 8 hsqldb
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Integration Camel K 1 hsqldb
    affected: workaround, no fix available
  • Red Hat Integration Camel Quarkus 1 hsqldb
    affected: workaround, no fix available “Fix deferred”
  • Red Hat JBoss Data Grid 7 hsqldb Red Hat JBoss Enterprise Application Platform 6 hsqldb, jboss-on jboss-on Red Hat JBoss Fuse 6 hsqldb Red Hat JBoss Fuse Service Works 6 hsqldb Red Hat JBoss Operations Network 3 hsqldb, jboss-on jboss-on, org.jboss.on-jboss-on-parent org.jboss.on-jboss-on-parent
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes hsqldb
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: workaround, no fix available
  • Red Hat Enterprise Linux Client Optional (v. 7) hsqldb 1.8.1.3-15.el7_9, hsqldb-demo 1.8.1.3-15.el7_9, hsqldb-manual 1.8.1.3-15.el7_9, hsqldb-javadoc 1.8.1.3-15.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) hsqldb 1.8.1.3-15.el7_9, hsqldb-demo 1.8.1.3-15.el7_9, hsqldb-manual 1.8.1.3-15.el7_9, hsqldb-javadoc 1.8.1.3-15.el7_9
    fixed: vendor fix RHSA-2022:8560
  • Red Hat Enterprise Linux Server (v. 6 ELS) hsqldb 1.8.0.10-13.el6_10
    fixed: vendor fix RHSA-2022:8559
show 12 more
  • Red Hat Enterprise Linux Server (v. 7) hsqldb 1.8.1.3-15.el7_9
    fixed: vendor fix RHSA-2022:8560
  • Red Hat Enterprise Linux Server Optional (v. 6 ELS) hsqldb 1.8.0.10-13.el6_10, hsqldb-demo 1.8.0.10-13.el6_10, hsqldb-manual 1.8.0.10-13.el6_10, hsqldb-javadoc 1.8.0.10-13.el6_10
    fixed: vendor fix RHSA-2022:8559
  • Red Hat Enterprise Linux Server Optional (v. 7) hsqldb 1.8.1.3-15.el7_9, hsqldb-demo 1.8.1.3-15.el7_9, hsqldb-manual 1.8.1.3-15.el7_9, hsqldb-javadoc 1.8.1.3-15.el7_9 Red Hat Enterprise Linux Workstation (v. 7) hsqldb 1.8.1.3-15.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) hsqldb-demo 1.8.1.3-15.el7_9, hsqldb-manual 1.8.1.3-15.el7_9, hsqldb-javadoc 1.8.1.3-15.el7_9
    fixed: vendor fix RHSA-2022:8560
  • Red Hat Fuse 7.11.1
    fixed: vendor fix RHSA-2022:8652
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.10-6.GA_redhat_00002.1.el7eap, eap7-netty 4.1.86-1.Final_redhat_00001.1.el7eap, eap7-apache-mime4j 0.8.9-1.redhat_00001.1.el7eap, eap7-undertow 2.2.23-1.SP2_redhat_00001.1.el7eap, eap7-artemis-native 1.0.2-4.redhat_00004.1.el7eap, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el7eap, +100 more
    fixed: vendor fix RHSA-2023:1512
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.10-6.GA_redhat_00002.1.el8eap, eap7-netty 4.1.86-1.Final_redhat_00001.1.el8eap, eap7-apache-mime4j 0.8.9-1.redhat_00001.1.el8eap, eap7-undertow 2.2.23-1.SP2_redhat_00001.1.el8eap, eap7-artemis-native 1.0.2-4.redhat_00004.1.el8eap, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el8eap, +101 more
    fixed: vendor fix RHSA-2023:1513
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.10-6.GA_redhat_00002.1.el9eap, eap7-netty 4.1.86-1.Final_redhat_00001.1.el9eap, eap7-apache-mime4j 0.8.9-1.redhat_00001.1.el9eap, eap7-undertow 2.2.23-1.SP2_redhat_00001.1.el9eap, eap7-artemis-native 1.0.2-4.redhat_00004.1.el9eap, eap7-snakeyaml 1.33.0-2.SP1_redhat_00001.1.el9eap, +100 more
    fixed: vendor fix RHSA-2023:1514
  • Red Hat JBoss Enterprise Application Platform h2 1.4.197.redhat-00004
    fixed: vendor fix RHSA-2023:1516
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-avro 1.7.6-2.redhat_00003.1.ep7.el7, eap7-xalan-j2 2.7.1-26.redhat_00015.1.ep7.el7, eap7-wildfly 7.1.8-2.GA_redhat_00002.1.ep7.el7, eap7-h2database 1.4.197-2.redhat_00005.1.ep7.el7, eap7-bouncycastle 1.68.0-1.redhat_00005.1.ep7.el7, eap7-apache-cxf 3.1.16-3.SP1_redhat_00001.1.ep7.el7, +11 more
    fixed: vendor fix RHSA-2024:10208
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-avro 1.7.6-8.redhat_00003.1.el7eap, eap7-wss4j 2.3.3-2.redhat_00001.1.el7eap, eap7-xalan-j2 2.7.1-38.redhat_00015.1.el7eap, eap7-wildfly 7.3.11-4.GA_redhat_00002.1.el7eap, eap7-h2database 1.4.197-3.redhat_00004.1.el7eap, eap7-wss4j-policy 2.3.3-2.redhat_00001.1.el7eap, +41 more
    fixed: vendor fix RHSA-2024:10207
  • Red Hat RHINT Camel-Springboot 3.20.1
    fixed: vendor fix RHSA-2023:2100
  • Red Hat A-MQ Clients 2 hsqldb Red Hat Decision Manager 7 hsqldb Red Hat Enterprise Linux 8 autocorr-af, autocorr-bg, autocorr-ca, autocorr-cs, autocorr-da, autocorr-de, +98 more Red Hat Enterprise Linux 9 autocorr-af, autocorr-bg, autocorr-ca, autocorr-cs, autocorr-da, autocorr-de, +101 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1541 more Red Hat JBoss Enterprise Application Platform Expansion Pack hsqldb
    +2 more products
    Red Hat Process Automation 7 hsqldb Red Hat streams for Apache Kafka hsqldb
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

5.15% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.hsqldb:hsqldb
<2.7.1
2.7.1

Affected products

  • HyperSQL DataBase hsqldb

Classification

Weakness
  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.