CVE-2024-45397: H2O alllows bypassing address-based access control with 0-RTT
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by packets with a spoofed source address. This behavior allows attackers on the network to execute HTTP requests from addresses that are otherwise rejected by the address-based access control. The vulnerability has been addressed in commit 15ed15a. Users may disable the use of TCP FastOpen and QUIC to mitigate the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
h2oto a version that resolves this vulnerability.Patch 15ed15a - Configuration
Disable the use of TCP FastOpen and QUIC to mitigate the address-based access-control bypass.
h2o TCP FastOpen and QUIC = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45397?
CVE-2024-45397 is classified as a moderate severity vulnerability affecting the h2o HTTP server.
How do I fix CVE-2024-45397?
To address CVE-2024-45397, update your h2o server to a version released after October 10, 2024.
What software is affected by CVE-2024-45397?
CVE-2024-45397 affects the h2o HTTP server versions prior to 2024-10-10.
What is the impact of CVE-2024-45397 on my server?
CVE-2024-45397 may allow unauthorized access through IP-address-based controls when using early data with TLS/1.3.
Is there a workaround for CVE-2024-45397?
Currently, the recommended solution for CVE-2024-45397 is to upgrade to the latest version of the h2o server.