Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

H2 dependency 1.4.197 is vulnerable to remote code execution (CVE-2018-10054) #558

Closed
jvmtomte opened this issue May 2, 2019 · 0 comments
Closed

H2 dependency 1.4.197 is vulnerable to remote code execution (CVE-2018-10054) #558

jvmtomte opened this issue May 2, 2019 · 0 comments
Milestone
0.14.1

Comments

@jvmtomte
Copy link

jvmtomte commented May 2, 2019

For the current Exposed version 0.13.6 the H2 version 1.4.197 is used. This dependency is reported to be vulnerable to remote code execution (see https://nvd.nist.gov/vuln/detail/CVE-2018-10054). Exposed should use a H2 dependency > 1.4.197.

This issue relates to #530
Tapac added a commit that referenced this issue Jun 2, 2019
@Tapac
#530 Exposed does not work with just-released H2Database (1.4.199)
f04af1d 
#558 H2 dependency 1.4.197 is vulnerable to remote code execution (CVE-2018-10054)
@Tapac Tapac closed this as completed Jun 2, 2019
@Tapac Tapac modified the milestones: 0.13.1, 0.14.1 Jun 3, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
0.14.1
Development

No branches or pull requests
2 participants
@Tapac @jvmtomte