Approved changes feed: RSS · Atom
cpe:2.3:a:mvnrepository:h2o-core:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Mvnrepository (0d14b95f-39e5-5f62-affd-c272584a1cdb) |
|---|---|
| Product | H2O Core (29ba77fd-f0aa-50ee-8181-d36c5c0764c0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-6960 |
vulnerable | 2026-06-08 06:58:20.840691 |
H2O deserializes ML models without filtering, potentially allowing execution of malicious code
HIGH (7.5)
The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized (no class whitelist). An attacker can construct a crafted Iced model that uses Java gadgets and leads to arbitrary code execution when imported to the H2O platform.
Published: 2024-07-21T09:55:20.625Z
Updated: 2024-11-25T12:47:17.311Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.