GitHub Advisoryadvisory · PyPI, Maven

GHSA-wjpv-64v2-2qpq H2O Vulnerable to Denial of Service (DoS) and File Write

HIGH Published 2025-03-20 Modified 2025-03-20 Official page ↗
Aliases
CVE-2024-10572
Ecosystem
PyPI, Maven
Packages
h2o, ai.h2o:h2o-ext-xgboost
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-94
Reviewed
2025-03-20

Affected packages

• PyPI h2o: >= 3.34.0.1, <= 3.46.0.1 (no fix yet) • Maven ai.h2o:h2o-ext-xgboost: >= 3.34.0.1, <= 3.46.0.1 (no fix yet)

Description

In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExtractTool` class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service.

Related

Alias · CVE (1)

  • CVE-2024-10572 In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-94 Improper Control of Generation of Code weakness

References