com.h2database:[email protected] vulnerabilities

Question

How can I get rid of this issue from the project? Should I stop using the H2 database?

I also found that there isn't any fixed version for com.h2database:h2.

CVE-2022-45868 7.8 Cleartext Storage of Sensitive Information vulnerability pending CVSS allocation

Answer 1

It isn't a real vulnerability and currently it is marked as disputed.

A so-called exploit puts a password in a potentially insecure place by itself and starts the H2 Server process with this possibly compromised (depending on the environment) password after that. The author of that fake exploit blames H2 for the password exposure, but the password isn't exposed by H2; it is exposed by code that starts H2. Unfortunately, many projects receive various strange reports about fictional vulnerabilities and sometimes they are promoted to CVEs.

The last version of the H2 database with a known real vulnerabilities is probably 1.4.200. The last version of H2 Console with known real vulnerabilities is 2.0.206. Both versions are relatively old.

But if some code inspection tool marks 2.1.214 as vulnerable and you cannot disable this warning, you can use the latest H2 2.2.220; it shouldn't be marked as vulnerable. This version actually has some additional protection from attempts to do stupid things with these passwords.

Answer 2

That CVE should never have been created. It is not a bug, and there is nothing to fix. You can continue to use H2.

See this issue comment for a thorough explanation by the library author(s).