JVN#84182676
Multiple vulnerabilities in H2O

Overview

H2O contains multiple vulnerabilities.

Products Affected

• H2O version 2.2.2 and earlier (CVE-2017-10868, CVE-2017-10869)
• H2O version 2.2.3 and earlier (CVE-2017-10872, CVE-2017-10908)

Description

H2O is an open source web server software. H2O contains multiple vulnerabilities listed below.

• A Denial-of-service (DoS) due to a flaw in processing HTTP/1 header (CWE-20) - CVE-2017-10868

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	Base Score: 5.3
  CVSS v2	AV:N/AC:L/Au:N/C:N/I:N/A:P	Base Score: 5.0

• Stack-based buffer overflow (CWE-121) - CVE-2017-10869

  CVSS v3	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L	Base Score: 3.7
  CVSS v2	AV:N/AC:M/Au:N/C:N/I:N/A:P	Base Score: 4.3

• A Denial-of-service (DoS) due to a flaw in outputting of the access log (CWE-118) - CVE-2017-10872

  CVSS v3	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L	Base Score: 3.1
  CVSS v2	AV:N/AC:M/Au:S/C:N/I:N/A:P	Base Score: 3.5

• A Denial-of-service (DoS) due to a flaw in processing HTTP/2 header (CWE-20) - CVE-2017-10908

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	Base Score: 5.3
  CVSS v2	AV:N/AC:L/Au:N/C:N/I:N/A:P	Base Score: 5.0

Impact

A denial-of-service (DoS) attack to a server may be conducted by an unauthenticated remote attacker.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.