CVE-2024-45397: H2O alllows bypassing address-based access control with 0-RTT
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by packets with a spoofed source address. This behavior allows attackers on the network to execute HTTP requests from addresses that are otherwise rejected by the address-based access control. The vulnerability has been addressed in commit 15ed15a. Users may disable the use of TCP FastOpen and QUIC to mitigate the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45397?
CVE-2024-45397 is classified as a moderate severity vulnerability affecting the h2o HTTP server.
How do I fix CVE-2024-45397?
To address CVE-2024-45397, update your h2o server to a version released after October 10, 2024.
What software is affected by CVE-2024-45397?
CVE-2024-45397 affects the h2o HTTP server versions prior to 2024-10-10.
What is the impact of CVE-2024-45397 on my server?
CVE-2024-45397 may allow unauthorized access through IP-address-based controls when using early data with TLS/1.3.
Is there a workaround for CVE-2024-45397?
Currently, the recommended solution for CVE-2024-45397 is to upgrade to the latest version of the h2o server.