H2O vulnerable to Deserialization of Untrusted Data

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-6960 · ADVISORY
• h2oai/h2o-3 · PACKAGE
• mvnrepository.com/artifact/ai.h2o/h2o-core · WEB
• research.jfrog.com/vulnerabilities/h2o-model-deserialization-rce-jfsa-2024-001035518 · WEB
• research.jfrog.com/vulnerabilities/h2o-model-deserialization-rce-jfsa-2024-001035518

ai.h2o:h2o-core のその他の脆弱性

• CVE-2026-3960緊急 9.8A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 …
• CVE-2024-5986緊急 9.1A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved …
• CVE-2025-6544緊急 9.8A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute ar…
• CVE-2024-8616高 8.2In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerabi…
• CVE-2024-8062高 7.5A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` reque…