ai.h2o:h2o-app (0.1.23), ai.h2o:sparkling-water-core_2.10 (0.2.7) +1 more potentially affected by CVE-2024-6960 via ai.h2o:h2o-core (0.1.23)

ai.h2o:h2o-core MAVEN version 0.1.23 is affected by a known vulnerability. The following packages have a transitive dependency on ai.h2o:h2o-core and may be impacted: - ai.h2o:h2o-app 0.1.23 - ai.h2o:sparkling-water-core2.10 0.2.7 - ai.h2o:sparkling-water-examples2.10 0.2.7 Source cves:...

CVE-2024-6960 H2O deserializes ML models without filtering, potentially allowing execution of malicious code

The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized no class whitelist. An attacker can construct ...