{
  "@id": "urn:uuid:249c0198-0dbc-49cb-bf84-88b0a34fa8ff",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T09:57:00.045220+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.h2database/h2@2.1.210-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.h2database/h2@2.1.210-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2021-23463 does not affect version 2.1.210-tuxcare.1 of com.h2database:h2. Target version 2.1.210 is NOT affected by CVE-2021-23463. Comprehensive XXE protections are present in JdbcSQLXML.java, matching the vendor patch semantically. The fix (commit d83285fd2e48) was authored by upstream maintainer Andrei Tokar and was already included in the upstream 2.1.210 release when TuxCare onboarded it. The vulnerable pattern (XML parsing without XXE defenses) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.4.198, < 2.0.202), NVD (>= 1.4.198, < 2.0.202), cve.org (< 2.0.202), Snyk (>= 1.4.198, < 2.0.202).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-23463"
      },
      "impact_statement": "Target version 2.1.210 is NOT affected by CVE-2021-23463. Comprehensive XXE protections are present in JdbcSQLXML.java, matching the vendor patch semantically. The fix (commit d83285fd2e48) was authored by upstream maintainer Andrei Tokar and was already included in the upstream 2.1.210 release when TuxCare onboarded it. The vulnerable pattern (XML parsing without XXE defenses) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.4.198, < 2.0.202), NVD (>= 1.4.198, < 2.0.202), cve.org (< 2.0.202), Snyk (>= 1.4.198, < 2.0.202)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.h2database/h2@2.1.210-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.h2database/h2@2.1.210-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T09:57:00.045220+00:00",
      "status_notes": "Vulnerability CVE-2021-42392 does not affect version 2.1.210-tuxcare.1 of com.h2database:h2. Target version 2.1.210 is NOT vulnerable to CVE-2021-42392 (JNDI injection). The fix was already present in the upstream 2.1.210 release that TuxCare onboarded. The JNDI URL scheme validation (requiring \"java:\" prefix) is implemented in JdbcUtils.java:319-321, blocking remote schemes like ldap:// and rmi:// that enable remote class loading. Both attack vectors mentioned in the CVE (H2 Console and linked tables) flow through this protected code path.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-42392"
      },
      "impact_statement": "Target version 2.1.210 is NOT vulnerable to CVE-2021-42392 (JNDI injection). The fix was already present in the upstream 2.1.210 release that TuxCare onboarded. The JNDI URL scheme validation (requiring \"java:\" prefix) is implemented in JdbcUtils.java:319-321, blocking remote schemes like ldap:// and rmi:// that enable remote class loading. Both attack vectors mentioned in the CVE (H2 Console and linked tables) flow through this protected code path."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.h2database/h2@2.1.210-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.h2database/h2@2.1.210-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:58:00.062525+00:00",
      "status_notes": "Vulnerability CVE-2022-23221 does not affect version 2.1.210-tuxcare.1 of com.h2database:h2. Target version 2.1.210-tuxcare.1 is NOT AFFECTED by CVE-2022-23221. The vulnerability allowed remote code execution via JDBC URLs containing IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT to bypass security controls. The upstream fix (commit eb75633d by Evgenij Ryazanov) changed how FORBID_CREATION is enforced: from URL string concatenation (bypassable) to programmatic property setting via JdbcConnection constructor (not bypassable). This fix was already present in upstream H2 release 2.1.210, which TuxCare onboarded in commit 28f30d4ce. Additional defense-in-depth via Host header validation (commit 456c2d03) is also present. Both fixes are confirmed in the target code at HEAD (2243fc3d7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.210), NVD (>= 1.1.100, < 2.0.206), Snyk (< 2.1.210).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-23221"
      },
      "impact_statement": "Target version 2.1.210-tuxcare.1 is NOT AFFECTED by CVE-2022-23221. The vulnerability allowed remote code execution via JDBC URLs containing IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT to bypass security controls. The upstream fix (commit eb75633d by Evgenij Ryazanov) changed how FORBID_CREATION is enforced: from URL string concatenation (bypassable) to programmatic property setting via JdbcConnection constructor (not bypassable). This fix was already present in upstream H2 release 2.1.210, which TuxCare onboarded in commit 28f30d4ce. Additional defense-in-depth via Host header validation (commit 456c2d03) is also present. Both fixes are confirmed in the target code at HEAD (2243fc3d7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.1.210), NVD (>= 1.1.100, < 2.0.206), Snyk (< 2.1.210)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.h2database/h2@2.1.210-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.h2database/h2@2.1.210-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45868 is fixed in version 2.1.210-tuxcare.1 of com.h2database:h2.",
      "vulnerability": {
        "name": "CVE-2022-45868"
      }
    }
  ]
}