[Japanese]

JVNDB-2018-000061

H2O vulnerable to buffer overflow

Overview

H2O is open source web server software. H2O contains a buffer overflow vulnerability (CWE-119) due to a processing flaw in the output of Access Log.

Marlies Ruck of ForAllSecure reported this vulnerability to Kazuho Oku, and Kazuho Oku reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Kazuho Oku coordinated under the Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.3 (High) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low
CVSS V2 Severity:
Base Metrics 7.5 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
Affected Products


Kazuho Oku
  • H2O version 2.2.4 and earlier

Impact

A remote attacker may be able to cause a denial-of-service (DoS) condition or may execute arbitrary code.
Solution

[Update the Software]
Update to the latest version according to the information provided by the developer.
Vendor Information

Kazuho Oku
CWE (What is CWE?)

  1. Buffer Errors(CWE-119) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2018-0608
References

  1. JVN : JVN#93226941
  2. National Vulnerability Database (NVD) : CVE-2018-0608
Revision History

  • [2018/06/04]
      Web page was published
  • [2019/07/01]
      References : Content was added

Date Public2018/06/04
Date First Published2018/06/04
Date Last Updated2018/06/04