h2o-3 vulnerabilities

A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, allowing attackers to bypass these controls.

In h2oai h2o-3 up to 7402, the importFiles function in PersistNFS.java (ImportFile API component) leads to information disclosure. The attack can be executed remotely, and a public exploit is available.

A vulnerability was found in h2oai h2o-3 up to version 3.46.08. The impacted element is an unknown function of the /99/ImportSQLTable file related to the IBMDB2 JDBC Driver component. Manipulation of the connection_url argument causes deserialization, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.