CVE-2024-45758
2 advisories.
PyPI/h2o CVE-2024-45758: critical 9.1
H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.46.0.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-hrmc-jmp7-mpm2
- https://nvd.nist.gov/vuln/detail/CVE-2024-45758
- https://github.com/h2oai/h2o-3/issues/16425
- https://github.com/h2oai/h2o-3/issues/16622
- https://github.com/h2oai/h2o-3/pull/16624
- https://github.com/h2oai/h2o-3/commit/f714edd6b8429c7a7211b779b6ec108a95b7382d
- https://gist.github.com/AfterSnows/c24ca3c26dc89ab797e610e92a6a9acb
- https://github.com/h2oai/h2o-3
- https://spear-shield.notion.site/Unauthenticated-Remote-Code-Execution-via-Unrestricted-JDBC-Connection-87a958a4874044199cbb86422d1f6068
CVE-2024-45758 · published · modified · JSON
PyPI/h2o CVE-2024-45758: critical 9.1
H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.46.0.7 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-352
- https://nvd.nist.gov/vuln/detail/CVE-2024-45758
- https://github.com/h2oai/h2o-3/issues/16425
- https://github.com/h2oai/h2o-3/issues/16622
- https://github.com/h2oai/h2o-3/pull/16624
- https://github.com/h2oai/h2o-3/commit/f714edd6b8429c7a7211b779b6ec108a95b7382d
- https://gist.github.com/AfterSnows/c24ca3c26dc89ab797e610e92a6a9acb
- https://github.com/h2oai/h2o-3
- https://spear-shield.notion.site/Unauthenticated-Remote-Code-Execution-via-Unrestricted-JDBC-Connection-87a958a4874044199cbb86422d1f6068
- https://pypi.org/project/h2o
- https://github.com/advisories/GHSA-hrmc-jmp7-mpm2
CVE-2024-45758 · published · modified · JSON