To be fair, it is possible for a command to obfuscate it's own command line (I've seen this in `ps auwx` but can't offhand recall which command was doing it).
But in no way is that high - CVE ratings have turned to useless junk quite rapidly, probably sometime around when it became monetizable.
Obfuscating your commandline is racy. The only fix for issues like this is to not pass passwords on the commandline, except when debugging.
Re:Disputed, Not Rejected
by happymellon on Thursday February 22, 2024 @12:24PM
(#39470195)
Yeah, having to deal with the level 10 CVE for Postgres from Tuesday.
https://nvd.nist.gov/vuln/detail/CVE-2024-1597
Postgres drivers are now all highly vulnerable and blocked in our pipelines because of overeager security, level 10 means that we can't get waivers for it either.
But you can't exploit because no one uses PreferQueryMode=SIMPLE.
https://nvd.nist.gov/vuln/detail/CVE-2022-45868
Total waste of everybody's time. You have to start h2 as server, instead of as dependency. You then have to start it with a command line parameter with a password, instead of specifying it in a config file. Both actions scream debug-configuration. If you do this, then... the password is readable on the command line.
That's the whole vulnerability. Analogy: if you leave a key on the table, people inside the same house can take it, and that's a vulnerability for the door.
So now h2 is 'vulnerable', every application needs to upgrade the dependency, and everybody needs to upgrade the application. What a total waste of time.