PT-2024-21042 · H2O+1 · H2O+1

Utrenkner · Published 2024-10-11 · Updated 2024-11-12 · CVE-2024-25622

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions h2o versions prior to the version containing commit 123f5e2b65dcdba8f7ef659a00d24bd1249141be

Description h2o is an HTTP server with support for HTTP/1.x, HTTP/2, and HTTP/3. The configuration directives provided by the headers handler allow users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes are expected to inherit the configuration defined in outer scopes. However, if a header directive is used in the inner scope, all the definitions in outer scopes are ignored. This can lead to headers not being modified as expected, potentially causing unexpected client behavior due to added or removed headers.

Recommendations For versions prior to the version containing commit 123f5e2b65dcdba8f7ef659a00d24bd1249141be, update to a version that includes this commit to resolve the issue. As a temporary workaround, consider reviewing and adjusting the configuration directives in the headers handler to minimize the risk of unexpected client behavior. Restrict access to sensitive areas of the configuration file to prevent unintended modifications.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2024-25622

GHSA-5M7V-CJ65-H6PJ

Affected Products

Debian

H2O

References · 16

• 🔥 https://github.com/h2o/h2o/security/advisories/GHSA-5m7v-cj65-h6pj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25622.json · Exploit
• https://github.com/h2o/h2o/commit/123f5e2b65dcdba8f7ef659a00d24bd1249141be · Patch
• https://cve.org/CVERecord?id=CVE-2024-25622 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-25622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25622 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25622 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-25622 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-25622 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-25622 · Vendor Advisory
• https://github.com/h2o/h2o/issues/3332 · Note
• https://t.me/cvenotify/101433 · Telegram Post
• https://twitter.com/transilienceai/status/1845874104911777965 · Twitter Post
• https://t.me/cvedetector/7690 · Telegram Post
• https://twitter.com/transilienceai/status/1845874093016682728 · Twitter Post