EulerOS 2.0 SP5 : hsqldb (EulerOS-SA-2023-2147)

critical Nessus Plugin ID 177014

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the hsqldb package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

- Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property 'hsqldb.method_class_names' to classes which are allowed to be called. For example, System.setProperty('hsqldb.method_class_names', 'abc') or Java argument
-Dhsqldb.method_class_names='abc' can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled. (CVE-2022-41853)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected hsqldb packages.

Plugin Details

Severity: Critical

ID: 177014

File Name: EulerOS_SA-2023-2147.nasl

Version: 1.0

Type: local

Family: Huawei Local Security Checks

Published: 6/9/2023

Updated: 6/9/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-41853

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:huawei:euleros:hsqldb, cpe:/o:huawei:euleros:2.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp

Excluded KB Items: Host/EulerOS/uvp_version

Exploit Ease: No known exploits are available

Patch Publication Date: 6/8/2023

Vulnerability Publication Date: 10/6/2022

Reference Information

CVE: CVE-2022-41853

Detections

Analytics