Improper Input Validation in Datomic

HIGH 8.8CVE-2018-10054 · GHSA-9pf8-qqhm-7w64 · Published 11/04/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
com.datomic:datomic-free Maven	`< 0.9.5697`	`0.9.5697`
datomic cognitect	`< 0.9.5697`	`0.9.5697`
h2 h2database	`= 1.4.197`	No fix yet

Description

H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code.

NVD description

H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is "h2 is not designed to be run outside of a secure environment."

References

nvd.nist.gov/vuln/detail/CVE-2018-10054 · ADVISORY
h2database/h2database · WEB
h2database/h2database · WEB
h2database/h2database · WEB
forum.datomic.com/t/important-security-update-0-9-5697/379 · WEB
lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e%40%3Cuser.ignite.apache.org%3E · WEB
lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e@%3Cuser.ignite.apache.org%3E · WEB
lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540%40%3Ccommits.nifi.apache.org%3E · WEB
lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540@%3Ccommits.nifi.apache.org%3E · WEB
mthbernardes.github.io/rce/2018/03/14/abusing-h2-database-alias.html · WEB
security.netapp.com/advisory/ntap-20240719-0003 · WEB
exploit-db.com/exploits/44422 · WEB
blog.datomic.com/2018/03/important-security-update.html · WEB
security.netapp.com/advisory/ntap-20240719-0003
exploit-db.com/exploits/44422 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free