DLA-4290-1 python-h2 - security update

Bulletin has no description...

Linux Distros Unpatched Vulnerability : CVE-2022-45868

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specif...

OPENSUSE-SU-2025:15496-1 python311-h2-4.3.0-1.1 on GA media

These are all security issues fixed in the python311-h2-4.3.0-1.1 package on the GA media of openSUSE Tumbleweed...

CRLF Injection

Overview h2 is a Pure-Python HTTP/2 protocol implementation Affected versions of this package are vulnerable to CRLF Injection due to insufficient validation in the request headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values,...

GHSA-63CX-G855-HVV4 mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

mitmproxy 12.1.1 and below embed python-hyper/h2 ≤ v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to http:// backends. It does not...

CVE-2025-57772

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's...

CVE-2025-57772 Dataease H2 JDBC RCE Bypass

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's...

Fedora: Security Advisory (FEDORA-2025-c22dd590b8)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-92fd810e1d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 41 : rust-h2 / uv (2025-92fd810e1d)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-92fd810e1d advisory. - Update uv to version 0.8.8. - Update the h2 crate to version 0.4.12. The builds in this update also address CVE-2025-54368. Tenable has extracted the...

Malicious code in h2-test-remix-oxygen (npm)

The package h2-test-remix-oxygen was found to contain malicious code...

MAL-2025-22085 Malicious code in h2-test-remix-oxygen (npm)

The package h2-test-remix-oxygen was found to contain malicious code...

Malicious code in h2-test-hydrogen (npm)

The package h2-test-hydrogen was found to contain malicious code...

Malicious code in cli-h2-test (npm)

The package cli-h2-test was found to contain malicious code...

Malicious code in h2-test-hydrogen-remix (npm)

The package h2-test-hydrogen-remix was found to contain malicious code...

MAL-2025-22084 Malicious code in h2-test-hydrogen-remix (npm)

The package h2-test-hydrogen-remix was found to contain malicious code...

MAL-2025-10062 Malicious code in @zalastax/nolb-_h2 (npm)

The package @zalastax/nolb-h2 was found to contain malicious code...

MAL-2025-22083 Malicious code in h2-test-hydrogen (npm)

The package h2-test-hydrogen was found to contain malicious code...

MAL-2025-17106 Malicious code in cli-h2-test (npm)

The package cli-h2-test was found to contain malicious code...

CVE-2025-48989 Apache Tomcat: h2 DoS - Made You Reset

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected...