Advisoriesby IbisH2O-3GHSA-wjpv-64v2-2qpq
H2O Vulnerable to Denial of Service (DoS) and File Write
No fix yet
In h2oai/h2o-3 version 3.46.0.1, the run_tool command exposes classes in the water.tools package through the ast parser. This includes the XGBoostLibExtractTool class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| h2o PyPI | >= 3.34.0.1, <= 3.46.0.1 | No fix yet |
Details and references
More H2O-3 advisories
All H2O-3
H2O Vulnerable to Arbitrary File OverwriteCVE-2024-8616no fix yetH2O Vulnerable to Denial of Service (DoS) via `HEAD` RequestCVE-2024-8062no fix yetH2O Vulnerable to Denial of Service (DoS) via Large GZIP ParsingCVE-2024-7765no fix yetH2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` EndpointCVE-2024-7768no fix yetH2O Vulnerable to Arbitrary File Overwrite via File ExportCVE-2024-6854no fix yetH2O Vulnerable to Execution of Arbitrary FilesCVE-2024-6863no fix yet