{
  "schema_version": "1.4.0",
  "id": "GHSA-wjpv-64v2-2qpq",
  "modified": "2025-03-20T19:13:16Z",
  "published": "2025-03-20T12:32:39Z",
  "aliases": [
    "CVE-2024-10572"
  ],
  "summary": "H2O Vulnerable to Denial of Service (DoS) and File Write",
  "details": "In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExtractTool` class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "h2o"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "3.34.0.1"
            },
            {
              "last_affected": "3.46.0.1"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "ai.h2o:h2o-ext-xgboost"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "3.34.0.1"
            },
            {
              "last_affected": "3.46.0.1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10572"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/h2oai/h2o-3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h2oai/h2o-3/blob/5e45e780f597961bda73adff765976db975f204b/h2o-extensions/xgboost/src/main/java/water/tools/XGBoostLibExtractTool.java#L12"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/db8939a0-9be8-4d0f-a8b0-1bd181666da2"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-20T19:13:16Z",
    "nvd_published_at": "2025-03-20T10:15:17Z"
  }
}