PT-2017-19189 · Apache · Apache Mesos

Publicado 2017-09-28 · Atualizado 2022-05-13 · CVE-2017-9790

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Mesos versions prior to 1.1.3 Apache Mesos versions 1.2.x prior to 1.2.2 Apache Mesos versions 1.3.x prior to 1.3.1 Apache Mesos version 1.4.0-dev

Description The issue occurs when handling a libprocess message wrapped in an HTTP request. If the request path is empty, it causes a crash because the parser assumes the request path always starts with '/'. A malicious actor can exploit this to cause a denial of service, rendering the Mesos-controlled cluster inoperable.

Recommendations For Apache Mesos versions prior to 1.1.3, update to version 1.1.3 or later. For Apache Mesos versions 1.2.x prior to 1.2.2, update to version 1.2.2 or later. For Apache Mesos versions 1.3.x prior to 1.3.1, update to version 1.3.1 or later. For Apache Mesos version 1.4.0-dev, update to a stable version that includes the fix.

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2017-9790

GHSA-VPCV-78CP-WHR3

Produtos afetados

Apache Mesos

Referências · 6

• https://osv.dev/vulnerability/GHSA-vpcv-78cp-whr3 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9790 · Nota de Segurança
• http://securityfocus.com/bid/101023 · Nota
• https://lists.apache.org/thread.html/cc1e7a69ea78da0511f5b54b6be7aa6e3c78edad5aaff430e7de028b%40%3Cdev.mesos.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2017-9790 · Aviso do Fabricante
• https://lists.apache.org/thread.html/cc1e7a69ea78da0511f5b54b6be7aa6e3c78edad5aaff430e7de028b@%3Cdev.mesos.apache.org%3E · Nota