CVE:CVE-2021-42392
CNNVD:CNNVD-202201-572
H2database是一个用 Java 编写的可嵌入 Rdbms。
H2database 存在安全漏洞，该漏洞源于H2数据库的getConnection方法以驱动的类名和数据库的URL作为参数。攻击者可利用该漏洞传递JNDI驱动程序名称和指向LDAP或RMI服务器的URL，从而导致远程代码执行。
solution:Upgrade h2database h2 to a higher version than 2.0.204,and avoid the version [1.1.000,2.0.204]; Upgrade debian debian_linux to a higher version than 9.0,10.0,11.0,and avoid the version 9.0,10.0,11.0; Upgrade oracle communications_cloud_native_core_policy to a higher version than 1.15.0,and avoid the version 1.15.0