{"data":{"id":"d2131fd2-b27e-4d99-8c95-aa3f4e8c841a","title":"CVE-2024-6960: The H2O machine learning platform uses \"Iced\" classes as the primary means of moving Java Objects around the cluster…","summary":"CVE-2024-6960 affects the H2O machine learning platform, which uses \"Iced\" classes to move Java objects around the cluster. The Iced format can carry serialized Java objects, and when a model is deserialized, any class is allowed, with no class whitelist. An attacker can craft an Iced model that uses Java gadgets and, when imported into H2O, achieve arbitrary code execution. The weakness is classified as CWE-502, Deserialization of Untrusted Data.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-6960","publishedAt":"2024-07-21T10:15:04.497Z","cveId":"CVE-2024-6960","cweIds":["CWE-502","CWE-502"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["ai.h2o:h2o-core@<= 3.46.0.4"],"affectedPackageNames":["ai-h2o:h2o-core"],"affectedPackageRefs":["maven:ai-h2o:h2o-core"],"affectedVendors":[],"affectedVendorsRaw":["H2O machine learning platform","H2O-core"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"H2O machine learning platform deserialization of untrusted model data","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00682,"epssCheckedAt":"2026-11-04T18:09:13.386Z","kevDateAdded":null,"advisoryAliases":["GHSA-w36w-948j-xhfw"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:31.725Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}