A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0.
[
{
"signature_version": "v1",
"digest": {
"length": 331.0,
"function_hash": "168816719982287770981110467877407296836"
},
"target": {
"file": "h2o-core/src/main/java/water/jdbc/SQLManager.java",
"function": "getConnectionSafe"
},
"id": "CVE-2024-10553-395c6987",
"source": "https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac",
"deprecated": false,
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"length": 607.0,
"function_hash": "190704215970352568582881088499490350282"
},
"target": {
"file": "h2o-core/src/main/java/water/jdbc/SQLManager.java",
"function": "importSqlTable"
},
"id": "CVE-2024-10553-4c363082",
"source": "https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac",
"deprecated": false,
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"300451468381251302729133872593402201545",
"252908786993601715595876974109271588348",
"10801937721548681594632862534605650681",
"9423190181843344384806367822050451322",
"227488768061697099239980640670601215227",
"316742949932481921682790972830828141023",
"221747699757561979942663759029883784899",
"174988231897645054029137978980406567093",
"338297435257418145061421683743409573372",
"108724650822201000318550971372101398772",
"170590909252239114651385301705348166597",
"203574655414930643365103733016374486186",
"203372091579464334002843783006599322199",
"226823000619405657601650876101252911533",
"211537658870709066147887120523182385619",
"337506303001316219262103506009455255380",
"123477289073643657779683900089844838158",
"116741747136631521503695341896450644192",
"182520457555272385502724177175461447459",
"131570643222693320033148107955518213557",
"209286989575944391901629413543522918514"
]
},
"target": {
"file": "h2o-core/src/main/java/water/jdbc/SQLManager.java"
},
"id": "CVE-2024-10553-72e872a7",
"source": "https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac",
"deprecated": false,
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"59195090619537486638448282897914155446",
"24561648639743877178903633622248367680"
]
},
"target": {
"file": "h2o-core/src/test/java/water/jdbc/SQLManagerTest.java"
},
"id": "CVE-2024-10553-cd692acb",
"source": "https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac",
"deprecated": false,
"signature_type": "Line"
}
]