CVE-2023-30847: H2O vulnerable to read from uninitialized pointer in the reverse proxy handler
H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers. Pull request number 3229 fixes the issue. The pull request has been merged to the `master` branch in commit f010336. Users should upgrade to commit f010336 or later.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this H2O vulnerability?
The vulnerability ID of this H2O vulnerability is CVE-2023-30847.
What is the severity of CVE-2023-30847?
The severity of CVE-2023-30847 is high with a CVSS score of 8.2.
What is the affected software for CVE-2023-30847?
The affected software for CVE-2023-30847 is H2O version 2.3.0-beta2 and prior.
How does CVE-2023-30847 affect H2O?
CVE-2023-30847 in H2O can lead to crashes or information leakage to the back-end HTTP server.
Are there any fixes or patches available for CVE-2023-30847?
Yes, fixes for CVE-2023-30847 are available. It is recommended to update to a version that includes the fix.