Denial of Service Vulnerability in H2O.ai H2O-3 Software

CVE-2024-10572

What is CVE-2024-10572?

In H2O.ai's H2O-3 version 3.46.0.1, the run_tool command inadvertently exposes classes within the water.tools package via the ast parser. This exposure includes the XGBoostLibExtractTool class, which can be manipulated by attackers to cause significant disruption. Specifically, this vulnerability allows malicious actors to crash the server and write large files to arbitrary directories, potentially leading to a complete denial of service.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References