H2O vulnerabilities, page 2
47 vulnerabilities
Known vulnerabilities in H2O products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
PrioritiseCVE-2024-7768h2oai · h2oai/h2o-3 +3 moreDenial of Service in h2oai/h2o-3A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.CVSS7.5HighEPSS0.79%RoutineCVE-2024-6863h2oai · h2oai/h2o-3 +3 moreEncryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerability makes it possible for an attacker to encrypt arbitrary files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryption.CVSS6.5MediumEPSS0.36%PrioritiseCVE-2024-8616h2oai · h2oai/h2o-3 +3 moreArbitrary File Overwrite in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.CVSS8.2HighEPSS0.56%PrioritiseCVE-2024-10550h2oai · h2oai/h2o-3 +3 moreDenial of Service by ReDOS in h2oai/h2o-3A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.CVSS7.5HighEPSS0.64%PrioritiseCVE-2024-6854h2oai · h2oai/h2o-3 +3 moreArbitrary File Overwrite in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.CVSS7.1HighEPSS0.78%PrioritiseCVE-2024-10572h2oai · h2oai/h2o-3 +3 moreDenial of Service and Arbitrary File Write in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExtractTool` class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service.CVSS7.5HighEPSS0.69%PrioritiseCVE-2024-10553h2oai · h2oai/h2o-3 +3 moreJdbc Deserialization in h2oai/h2o-3A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0.CVSS9.8CriticalEPSS1.59%PrioritiseCVE-2024-7765h2oai · h2oai/h2o-3 +3 moreDenial of Service in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.CVSS7.5HighEPSS0.78%PrioritiseCVE-2024-45402h2o · picotls +1 morePicotls double freePicotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, picotls (specifically, bindings within picotls that call the crypto libraries) may attempt to free the same memory twice. This double free occurs during the disposal of multiple objects without any intervening calls to malloc Typically, this triggers the malloc implementation to detect the error and abort the process. However, depending on the internals of malloc and the crypto backend being used, the flaw could potentially lead to a use-after-free scenario, which might allow for arbitrary code execution. The vulnerability is addressed with commit 9b88159ce763d680e4a13b6e8f3171ae923a535d.CVSS9.8CriticalEPSS0.48%PrioritiseCVE-2024-45396h2o · quicly +1 moreQuicly assertion failuresQuicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using quicly. The vulnerability is addressed with commit 2a95896104901589c495bc41460262e64ffcad5c.CVSS7.5HighEPSS0.58%RoutineCVE-2024-45403h2o +2 moreH2O assertion failure when HTTP/3 requests are cancelledh2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, the h2o standalone server automatically restarts, minimizing the impact. However, HTTP requests that were served concurrently will still be disrupted. The vulnerability has been addressed in commit 1ed32b2. Users may disable the use of HTTP/3 to mitigate the issue.CVSS7.5HighEPSS0.65%RoutineCVE-2024-45397h2o +3 moreH2O alllows bypassing address-based access control with 0-RTTh2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by packets with a spoofed source address. This behavior allows attackers on the network to execute HTTP requests from addresses that are otherwise rejected by the address-based access control. The vulnerability has been addressed in commit 15ed15a. Users may disable the use of TCP FastOpen and QUIC to mitigate the issue.CVSS7.5HighEPSS0.44%RoutineCVE-2024-25622h2o +3 moreH2O ignores headers configuration directivesh2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes (e.g., path level) are expected to inherit the configuration defined in outer scopes (e.g., global level). However, if a header directive is used in the inner scope, all the definition in outer scopes are ignored. This can lead to headers not being modified as expected. Depending on the headers being added or removed unexpectedly, this behavior could lead to unexpected client behavior. This vulnerability is fixed in commit 123f5e2b65dcdba8f7ef659a00d24bd1249141be.CVSS4.3MediumEPSS0.46%RoutineCVE-2024-8862h2oai · h2o-3 +2 moreh2oai h2o-3 JDBC Connection 1 getConnectionSafe deserializationA vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS9.8CriticalEPSS1.33%PrioritiseCVE-2024-45758h2o +2 moreh2o h2oH2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.CVSS9.1CriticalEPSS0.91%PrioritiseCVE-2024-5979h2oai · h2oai/h2o-3 +2 moreDenial of Service via Invalid Argument in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service.CVSS7.5HighEPSS0.79%RoutineCVE-2024-5550h2oai · h2oai/h2o-3 +2 moreExposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead API call, which when requested with a typeahead lookup of '/', exposes the root filesystem including directories such as /home, /usr, /bin, among others. This vulnerability could allow attackers to explore the entire filesystem, and when combined with a Local File Inclusion (LFI) vulnerability, could make exploitation of the server trivial.CVSS5.3MediumEPSS0.83%PrioritiseCVE-2024-1456h2oai · h2oai/h2o-3 +1 moreS3 Bucket Takeover in h2oai/h2o-3An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.CVSS7.1HighEPSS0.24%PrioritiseCVE-2023-6569h2oai · h2oai/h2o-3 +2 moreExternal Control of File Name or Path in h2oai/h2o-3CVSS9.3CriticalEPSS0.72%RoutineCVE-2023-50247h2o +1 moreh2o QUIC state exhaustion DoSh2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack (quicly), as used by H2O up to commit 43f86e5 (in version 2.3.0-beta and prior), is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressively increase the memory retained by the QUIC stack. This can eventually cause H2O to abort due to memory exhaustion. The vulnerability has been resolved in commit d67e81d03be12a9d53dc8271af6530f40164cd35. HTTP/1 and HTTP/2 are not affected by this vulnerability as they do not use QUIC. Administrators looking to mitigate this issue without upgrading can disable HTTP/3 support.CVSS7.5HighEPSS0.86%