Deserialization Of Untrusted Data

H2O is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unsafe deserialization of any class in Iced models due to a lack of a class whitelist, allowing attackers to use Java gadgets to execute arbitrary code...