CVE-2024-5979: Denial of Service via Invalid Argument in h2oai/h2o-3
Published Jun 27, 2024
·Updated
In h2oai/h2o-3 version 3.46.0, the runtool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service.
Affected Software
2 affected components
pip/h2o<=3.46.0
h2o h2o=3.46.0
Event History
Jun 27, 2024
CVE Published
via MITRE·06:40 PM
Data Sourced
via MITRE·06:40 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
Affected Software
Advisory Published
via GitHub·09:32 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-5979?
CVE-2024-5979 has been classified as a denial-of-service vulnerability.
2
How do I fix CVE-2024-5979?
To mitigate CVE-2024-5979, upgrade to a version of h2o-3 beyond 3.46.0 that has addressed this vulnerability.
3
What component is affected by CVE-2024-5979?
CVE-2024-5979 affects the `rapids` component within the h2oai/h2o-3 version 3.46.0.
4
What causes the denial-of-service in CVE-2024-5979?
The denial-of-service occurs when the `MojoConvertTool` crashes the server when invoked with invalid arguments.
5
Which versions of h2o are vulnerable to CVE-2024-5979?
All versions of h2o-3 up to and including 3.46.0 are vulnerable to CVE-2024-5979.