p PatchFirst

CVE-2024-10550

CVE-2024-10550 · Denial of Service by ReDOS in h2oai/h2o-3

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.

CVSS 7.5 · Alta · EPSS 0,6%

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • h2oai/h2o-3

    Versiones
    • ≥ unspecified, ≤ latest: Afectada (custom)

    Sin corrección publicada

  • h2o PyPI

    Versiones
    • 3.30.0.7
    • 3.30.1.1
    • 3.30.1.2
    • 3.30.1.3
    • 3.32.0.2
    • 3.32.0.3
    • 3.32.0.4
    • 3.32.0.5
    • 3.32.1.1
    • 3.32.1.2
    • 3.32.1.3
    • 3.32.1.4
    • 3.32.1.5
    • 3.32.1.6
    • 3.32.1.7
    • 3.34.0.3
    • 3.34.0.7
    • 3.34.0.8
    • 3.36.0.2
    • 3.36.0.3
    • 3.36.0.4
    • 3.36.1.1
    • 3.36.1.2
    • 3.36.1.3
    • 3.36.1.4
    • 3.36.1.5
    • 3.38.0.1
    • 3.38.0.2
    • 3.38.0.3
    • 3.38.0.4
    • 3.40.0.1
    • 3.40.0.2
    • 3.40.0.3
    • 3.40.0.4
    • 3.42.0.1
    • 3.42.0.2
    • 3.42.0.3
    • 3.42.0.4
    • 3.44.0.1
    • 3.44.0.2
    • 3.44.0.3
    • 3.46.0.1
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 3.30.0.7, ≤ 3.46.0.1

    Sin corrección publicada

  • ai.h2o:h2o-core Maven

    Versiones
    • 3.30.0.7
    • 3.30.1.1
    • 3.30.1.2
    • 3.30.1.3
    • 3.32.0.1
    • 3.32.0.2
    • 3.32.0.3
    • 3.32.0.4
    • 3.32.0.5
    • 3.32.1.1
    • 3.32.1.2
    • 3.32.1.3
    • 3.32.1.4
    • 3.32.1.5
    • 3.32.1.6
    • 3.32.1.7
    • 3.34.0.1
    • 3.34.0.3
    • 3.34.0.4
    • 3.34.0.5
    • 3.34.0.6
    • 3.34.0.7
    • 3.34.0.8
    • 3.35.0.2
    • 3.36.0.1
    • 3.36.0.2
    • 3.36.0.3
    • 3.36.0.4
    • 3.36.1.1
    • 3.36.1.2
    • 3.36.1.3
    • 3.36.1.4
    • 3.36.1.5
    • 3.38.0.1
    • 3.38.0.2
    • 3.38.0.3
    • 3.38.0.4
    • 3.40.0.1
    • 3.40.0.2
    • 3.40.0.3
    • 3.40.0.4
    • 3.42.0.1
    • 3.42.0.2
    • 3.42.0.3
    • 3.42.0.4
    • 3.44.0.1
    • 3.44.0.2
    • 3.44.0.3
    • 3.46.0.1
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 3.30.0.7, ≤ 3.46.0.1

    Sin corrección publicada

Fuentes originales

Comprueba tu servidor →