CVE-2024-6960: 
Java vulnerability analysis and mitigation

The H2O machine learning platform contains a critical vulnerability (CVE-2024-6960) discovered in July 2024. The vulnerability affects the h2o-core package versions <=3.46.0.4, where the platform's 'Iced' classes, used for moving Java Objects around the cluster, support inclusion of serialized Java objects without proper class whitelisting during deserialization (JFrog Research, NVD).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) with a CVSS v3.1 score of 7.5 (HIGH). The technical issue stems from the H2O platform's handling of 'Iced' format, which allows serialized Java objects to be included. When a model is deserialized, the platform fails to implement proper class filtering, allowing any class to be deserialized without restrictions (JFrog Research, Hacker News).

The vulnerability can lead to arbitrary code execution when an attacker-crafted Iced model is imported to the H2O platform. This poses significant risks as it could allow attackers to execute malicious code within the context of the H2O application (JFrog Research, Hacker News).

Users should avoid using versions <=3.46.0.4 of the ai.h2o/h2o-core package. No specific mitigations have been provided for this vulnerability (FortiGuard).