Denial of Service Vulnerability in H2O.ai H2O-3 Software

CVE-2024-10572

What is CVE-2024-10572?

In H2O.ai's H2O-3 version 3.46.0.1, the run_tool command inadvertently exposes classes within the water.tools package via the ast parser. This exposure includes the XGBoostLibExtractTool class, which can be manipulated by attackers to cause significant disruption. Specifically, this vulnerability allows malicious actors to crash the server and write large files to arbitrary directories, potentially leading to a complete denial of service.

References