NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · PyPI

CVE-2024-10553: H2O Deserialization of Untrusted Data Vulnerability

criticalCVSS 3.0 9.8GHSA-h7xg-cmpp-48hf

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the…

Published Mar 20, 2025

Affected packages

h2o

Ecosystem
PyPI
Affected
< 3.46.0.6
Fixed in
3.46.0.6
Check
pip show h2o

ai.h2o:h2o-core

Ecosystem
Maven
Affected
< 3.46.0.6
Fixed in
3.46.0.6
Check
mvn dependency:tree -Dincludes=ai.h2o:h2o-core

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.46.0.6.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More PyPI vulnerabilities

All PyPI entries