¡¾Îó²îͨ¸æ¡¿H2O-3 JDBC ·´ÐòÁл¯Îó²î (CVE-2025-6507)

Ðû²¼Ê±¼ä 2025-09-03

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

H2O-3 JDBC ·´ÐòÁл¯Îó²î

CVE   ID

CVE-2025-6507

Îó²îÀàÐÍ

·´ÐòÁл¯Îó²î

·¢Ã÷ʱ¼ä

2025-09-03

Îó²îÆÀ·Ö

9.8

Îó²îÆ·¼¶

ÑÏÖØ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ʹÓÃÄѶÈ

µÍ

Óû§½»»¥

²»ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


H2O-3ÊÇÓÉH2O.ai¿ª·¢µÄ¿ªÔ´ÂþÑÜʽ»úеѧϰƽ̨£¬Ö§³Ö´ó¹æÄ£Êý¾Ý´¦Öóͷ£Ó뽨ģ¡£ËüÌṩÁËÆÕ±éµÄËã·¨£¬°üÀ¨·ÖÀ࣬»Ø¹é£¬¾ÛÀ࣬Òì³£¼ì²âºÍÉî¶Èѧϰ£¬Äܹ»ÔÚ´óÊý¾ÝÇéÐÎϸßЧÔËÐС£H2O-3Ö§³Ö¶àÖÖ±à³Ì½Ó¿Ú£¬Èçpython£¬R£¬ScalaºÍJAVA£¬Í¬Ê±ÓëSpark£¬HadoopµÈÉú̬ϵͳ¼æÈÝ£¬Àû±ã¼¯³Éµ½ÆóÒµµÄÊý¾ÝÆÊÎöÁ÷³ÌÖУ¬ÆäÉè¼ÆÄ¿µÄÊÇΪÊý¾Ý¿Æѧ¼ÒºÍ¿ª·¢ÕßÌṩ¸ßÐÔÄÜ£¬Ò×À©Õ¹ÇÒÒ×ÓÚ°²ÅŵĻúеѧϰ½â¾ö¼Æ»®¡£


2025Äê9ÔÂ3ÈÕ£¬×ðÁú¿­Ê±¼¯ÍÅVSRC¼à²âµ½H2O-3±£´æJDBC ·´ÐòÁл¯Îó²î£¬¸ÃÎó²îÔ´ÓÚ²»ÊÜÐÅÍÐÊý¾ÝµÄ·´ÐòÁл¯£¬¿ÉÄܵ¼ÖÂÔ¶³Ì´úÂëÖ´ÐкÍϵͳÎļþµÄ¶ÁÈ¡¡£¹¥»÷Õß¿ÉÒÔͨ¹ýÈƹýÓÃÓÚ±ÜÃâ¶ñÒâ²ÎÊý×¢ÈëµÄÕýÔò±í´ïʽ¹ýÂËÆ÷À´Ê¹ÓøÃÎó²î£¬ÓÈÆäÊÇÔÚJDBCÅþÁ¬ÖС£¹¥»÷ÕßÄܹ»²Ù¿Ø²ÎÊýÖÐÐĵĿոñ£¬´Ó¶øÈƹý¼ì²â»úÖÆ£¬Ö´ÐÐδ¾­ÊÚȨµÄÏÂÁî»ò»á¼ûÊÜÏÞµÄÎļþ£¬ÕâʹµÃ¹¥»÷Õß¿ÉÒÔ»ñµÃ¶ÔÄ¿µÄϵͳµÄ¿ØÖÆȨÏÞ£¬½øÒ»²½Î£º¦ÏµÍ³µÄÇå¾²¡£


¶þ¡¢Ó°Ïì¹æÄ£


H2O-3 3.47.0.99999


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


ÒÑÐû²¼ÐÞ¸´°æ±¾£¬ÇëÉý¼¶µ½H2O-3 >= 3.46.0.8¡£


ÏÂÔØÁ´½Ó£ºhttps://github.com/h2oai/h2o-3/commit/f714edd6b8429c7a7211b779b6ec108a95b7382d


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬ïÔ̭ϵͳÎó²î£¬ÌáÉý·þÎñÆ÷µÄÇå¾²ÐÔ¡£
? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬Ð޸ķÀ»ðǽսÂÔ£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬ïÔÌ­½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬ïÔÌ­¹¥»÷Ãæ¡£
? Ê¹ÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£
? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£
? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£


3.4 ²Î¿¼Á´½Ó


https://nvd.nist.gov/vuln/detail/CVE-2025-6507
https://github.com/h2oai/h2o-3/commit/f714edd6b8429c7a7211b779b6ec108a95b7382d