CVE-2020-1963: 
Java vulnerability analysis and mitigation

CVE-2020-1963 is a critical file system disclosure vulnerability affecting Apache Ignite. The vulnerability was discovered in 2020 and affects all versions of Apache Ignite up to version 2.8. The issue stems from Apache Ignite's use of H2 database to build its SQL distributed execution engine (OSS Security).

The vulnerability exists because Apache Ignite uses H2 database to build its SQL distributed execution engine. H2 provides SQL functions that could be exploited by an attacker to gain unauthorized access to the filesystem for both read and write operations. The vulnerability is rated as Critical severity (OSS Security).

If exploited, this vulnerability allows attackers to access the filesystem for both read and write operations, potentially leading to unauthorized access to sensitive files and data on the system (OSS Security).

The vulnerability can be exploited through the use of embedded H2 SQL functions, which provide access to the filesystem. The attack vector requires the ability to execute SQL queries against the Apache Ignite system (OSS Security).

Users of Apache Ignite 2.8 or earlier versions should upgrade to version 2.8.1. If SQL is not used, the vulnerability can be mitigated by removing ignite-indexing.jar from the Ignite classpath. Additionally, the risk can be partially mitigated by running Apache Ignite using a non-privileged user account (OSS Security).