¡¾Îó²îͨ¸æ¡¿H2O-3 JDBC ·´ÐòÁл¯Îó²î (CVE-2025-6507)

Ðû²¼Ê±¼ä 2025-09-03

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

H2O-3 JDBC ·´ÐòÁл¯Îó²î

CVE   ID

CVE-2025-6507

Îó²îÀàÐÍ

·´ÐòÁл¯Îó²î

·¢Ã÷ʱ¼ä

2025-09-03

Îó²îÆÀ·Ö

9.8

Îó²îÆ·¼¶

ÑÏÖØ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ʹÓÃÄѶÈ

µÍ

Óû§½»»¥

²»ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


H2O-3ÊÇÓÉH2O.ai¿ª·¢µÄ¿ªÔ´ÂþÑÜʽ»úеѧϰƽ̨£¬£¬Ö§³Ö´ó¹æÄ£Êý¾Ý´¦Öóͷ£Ó뽨ģ¡£¡£¡£¡£ËüÌṩÁËÆÕ±éµÄËã·¨£¬£¬°üÀ¨·ÖÀ࣬£¬»Ø¹é£¬£¬¾ÛÀ࣬£¬Òì³£¼ì²âºÍÉî¶Èѧϰ£¬£¬Äܹ»ÔÚ´óÊý¾ÝÇéÐÎϸßЧÔËÐС£¡£¡£¡£H2O-3Ö§³Ö¶àÖÖ±à³Ì½Ó¿Ú£¬£¬Èçpython£¬£¬R£¬£¬ScalaºÍJAVA£¬£¬Í¬Ê±ÓëSpark£¬£¬HadoopµÈÉú̬ϵͳ¼æÈÝ£¬£¬Àû±ã¼¯³Éµ½ÆóÒµµÄÊý¾ÝÆÊÎöÁ÷³ÌÖУ¬£¬ÆäÉè¼ÆÄ¿µÄÊÇΪÊý¾Ý¿Æѧ¼ÒºÍ¿ª·¢ÕßÌṩ¸ßÐÔÄÜ£¬£¬Ò×À©Õ¹ÇÒÒ×ÓÚ°²ÅŵĻúеѧϰ½â¾ö¼Æ»®¡£¡£¡£¡£


2025Äê9ÔÂ3ÈÕ£¬£¬ÄϹ¬NGÓéÀÖ¼¯ÍÅVSRC¼à²âµ½H2O-3±£´æJDBC ·´ÐòÁл¯Îó²î£¬£¬¸ÃÎó²îÔ´ÓÚ²»ÊÜÐÅÈÎÊý¾ÝµÄ·´ÐòÁл¯£¬£¬¿ÉÄܵ¼ÖÂÔ¶³Ì´úÂëÖ´ÐкÍϵͳÎļþµÄ¶ÁÈ¡¡£¡£¡£¡£¹¥»÷Õß¿ÉÒÔͨ¹ýÈƹýÓÃÓÚ±ÜÃâ¶ñÒâ²ÎÊý×¢ÈëµÄÕýÔò±í´ïʽ¹ýÂËÆ÷À´Ê¹ÓøÃÎó²î£¬£¬ÓÈÆäÊÇÔÚJDBCÅþÁ¬ÖС£¡£¡£¡£¹¥»÷ÕßÄܹ»²Ù¿Ø²ÎÊýÖÐÐĵĿոñ£¬£¬´Ó¶øÈƹý¼ì²â»úÖÆ£¬£¬Ö´ÐÐδ¾­ÊÚȨµÄÏÂÁî»ò»á¼ûÊÜÏÞµÄÎļþ£¬£¬ÕâʹµÃ¹¥»÷Õß¿ÉÒÔ»ñµÃ¶ÔÄ¿µÄϵͳµÄ¿ØÖÆȨÏÞ£¬£¬½øÒ»²½Î£º¦ÏµÍ³µÄÇå¾²¡£¡£¡£¡£


¶þ¡¢Ó°Ïì¹æÄ£


H2O-3 3.47.0.99999


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


ÒÑÐû²¼ÐÞ¸´°æ±¾£¬£¬ÇëÉý¼¶µ½H2O-3 >= 3.46.0.8¡£¡£¡£¡£


ÏÂÔØÁ´½Ó£ºhttps://github.com/h2oai/h2o-3/commit/f714edd6b8429c7a7211b779b6ec108a95b7382d


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£¡£¡£¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬ïÔ̭ϵͳÎó²î£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£
? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬ïÔÌ­½«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬ïÔÌ­¹¥»÷Ãæ¡£¡£¡£¡£
? Ê¹ÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£
? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£
? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://nvd.nist.gov/vuln/detail/CVE-2025-6507
https://github.com/h2oai/h2o-3/commit/f714edd6b8429c7a7211b779b6ec108a95b7382d