PT-2018-18388 · Apache · Apache Mesos

Publicado

2018-09-21

·

Atualizado

2020-10-22

·

CVE-2018-8023

CVSS v3.1

5.9

Média

VetorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Apache Mesos versions prior to 1.4.2 Apache Mesos versions 1.5.0 Apache Mesos versions 1.5.1 Apache Mesos versions 1.6.0
Description: The issue concerns the comparison of the generated HMAC value against the provided signature in the JSON Web Token (JWT) implementation. Specifically, a standard == operator is used instead of a constant-time string comparison routine, making it vulnerable to a timing attack. This allows a malicious actor to exploit the timing difference of when the JWT validation function returns to reveal the correct HMAC value.
Recommendations: For Apache Mesos versions prior to 1.4.2, update to version 1.4.2 or later. For Apache Mesos versions 1.5.0, update to a version that includes the fix for this issue. For Apache Mesos versions 1.5.1, update to a version that includes the fix for this issue. For Apache Mesos versions 1.6.0, update to a version that includes the fix for this issue.

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

CVE-2018-8023
GHSA-C8CC-P3J7-4C7F

Produtos afetados

Apache Mesos