CVE-2018-10054

Description

H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code.

How to fix CVE-2018-10054

To remediate CVE-2018-10054, upgrade the affected package to a fixed version below.

• Maven/com.datomic:datomic-free—upgrade to 0.9.5697 or later

Is CVE-2018-10054 being exploited?

Likely — EPSS is 76.9%, placing CVE-2018-10054 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (1)

• from 0, < 0.9.5697

CVSS scores

References (13)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-10054
• WEBblog.datomic.com/2018/03/important-security-update.html
• WEBforum.datomic.com/t/important-security-update-0-9-5697/379
• WEBgithub.com/h2database/h2database/issues/1225