Japan Vulnerability NotesJVN:44566208JVN#44566208: H2O use-after-free vulnerability
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
0.004 Low
EPSS
Percentile
73.3%
H2O is an open source web server software. H2O contains a use-after-free vulnerability (CWE-416) due to a flaw in the process of upgrading from HTTP/1 to HTTP/2.
Impact
An unauthenticated remote attacker may cause a denial-of-service (DoS) condition or obtain arbitrary information which may include the server certificate’s private keys, depending on the software’s settings.
Solution
Update the Software
Update to the latest version according to the information provided by the developer.
Products Affected
- H2O version 2.0.4 and earlier
Related
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
0.004 Low
EPSS
Percentile
73.3%