High severity · published Apr 27, 2023
CVE-2023-30847
H2O is an HTTP server
8.2
CVSS
0.9%
EPSS
No
On KEV
Description
H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers. Pull request number 3229 fixes the issue. The pull request has been merged to the `master` branch in commit f010336. Users should upgrade to commit f010336 or later.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H2
H2o · Dena
through 2.2.6; 2.3.0; 2.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-30847
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-30847
Patch
https://github.com/h2o/h2o/commit/f010336bab162839df43d9e87570897466c97e33
Vendor Advisory
https://github.com/h2o/h2o/pull/3229
Patch
https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx
More from H2o
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
9.8
CVE-2018-0608
Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors
9.1
CVE-2016-7835
Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information
7.5
CVE-2024-45403
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3
7.5
CVE-2024-45397
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3