~ / search / GHSA-58m3-rcvp-f9ww

GHSA-58m3-rcvp-f9ww

h2o vulnerable to unexpected POST request shutting down server

Source: GitHub Advisory Database (reviewed) High CVE-2024-5979

Packages

EcosystemPackageAffectedFixed in
PyPI h2o <= 3.46.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service.

References

External links from the advisory. They lead to third-party sites.