CVE catalog
CVE-2022-41853
hsqldb: CVE-2022-41853
- Severity
- Critical · CVSS 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 5.15% · Oct 25, 2026
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | hsqldb | sid | 2.7.4-1 | fixed |
| Debian | hsqldb | forky | 2.7.4-1 | fixed |
| Debian | hsqldb | trixie | 2.7.4-1 | fixed |
| Debian | hsqldb | bookworm | 2.7.1-1+deb12u1 | fixed |
| Debian | hsqldb | bookworm-security | 2.7.1-1+deb12u1 | fixed |
| Suse | hsqldb | linux enterprise software development kit 12 sp5 | 2.2.9-5.3.1 | fixed |
| Opensuse | hsqldb | leap 15.3 | 2.3.3-150000.7.3.1 | fixed |
| Opensuse | hsqldb | leap 15.4 | 2.3.3-150000.7.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | hsqldb | source | sid | 2.7.1-1 | not yet assigned | Not reported | [1023573] |
| Debian | hsqldb | source | forky | 2.7.1-1 | not yet assigned | Not reported | [1023573] |
| Debian | hsqldb | source | trixie | 2.7.1-1 | not yet assigned | Not reported | [1023573] |
| Debian | hsqldb | source | bookworm | 2.7.1-1 | not yet assigned | Not reported | [1023573] |
| Suse | hsqldb | rpm | linux enterprise software development kit 12 sp5 | 2.2.9-5.3.1 | Not reported | SUSE-SU-2022:3864-1 | Not reported |
| Opensuse | hsqldb | rpm | leap 15.3 | 2.3.3-150000.7.3.1 | Not reported | SUSE-SU-2022:3823-1 | Not reported |
| Opensuse | hsqldb | rpm | leap 15.4 | 2.3.3-150000.7.3.1 | Not reported | SUSE-SU-2022:3823-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [hsqldb-utils]Fixed
Source package: [hsqldb]
Details (4)
2.7.1-1+deb12u1· all · bookwormFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
2.7.1-1+deb12u1· all · bookwormFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
2.7.1-1+deb12u1· all · bookworm-securityFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
2.7.1-1+deb12u1· all · bookworm-securityFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
- [libhsqldb-java]Fixed
Source package: [hsqldb]
Details (4)
2.7.1-1+deb12u1· all · bookwormFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
2.7.1-1+deb12u1· all · bookwormFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
2.7.1-1+deb12u1· all · bookworm-securityFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
2.7.1-1+deb12u1· all · bookworm-securityFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
- [libhsqldb-java-doc]Fixed
Source package: [hsqldb]
Details (4)
2.7.1-1+deb12u1· all · bookwormFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
2.7.1-1+deb12u1· all · bookwormFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
2.7.1-1+deb12u1· all · bookworm-securityFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
2.7.1-1+deb12u1· all · bookworm-securityFixed · Fixed:
2.7.1-1dsa · hsqldb · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2022_8560.json]
- [https://osv.dev/vulnerability/DLA-3234-1]
- [https://osv.dev/vulnerability/DSA-5313-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:3823-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:3864-1]
- [https://security-tracker.debian.org/tracker/CVE-2022-41853]
- [https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-41853.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1142.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]