PT-2019-8803 · Apache · Apache Mesos

Publicado 2019-03-05 · Atualizado 2019-03-07 · CVE-2018-11793

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Mesos versions prior to 1.4.x Apache Mesos versions 1.4.0 through 1.4.2 Apache Mesos versions 1.5.0 through 1.5.1 Apache Mesos versions 1.6.0 through 1.6.1 Apache Mesos version 1.7.0

Description The issue arises when parsing a JSON payload with deeply nested JSON structures, causing the parser to overflow the stack due to unbounded recursion. This can lead to a denial of service, rendering the Mesos-controlled cluster inoperable. A malicious actor can exploit this to cause significant disruption.

Recommendations For Apache Mesos versions prior to 1.4.x, update to version 1.4.x or later. For Apache Mesos versions 1.4.0 through 1.4.2, update to version 1.4.3 or later. For Apache Mesos versions 1.5.0 through 1.5.1, update to version 1.5.2 or later. For Apache Mesos versions 1.6.0 through 1.6.1, update to version 1.6.2 or later. For Apache Mesos version 1.7.0, update to version 1.7.1 or later.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2018-11793

GHSA-P2XQ-VCM7-XJJ6

Produtos afetados

Apache Mesos

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-11793 · Nota de Segurança
• http://securityfocus.com/bid/107281 · Nota
• https://osv.dev/vulnerability/CVE-2018-11793 · Aviso do Fabricante
• https://github.com/advisories/GHSA-p2xq-vcm7-xjj6 · Nota
• https://lists.apache.org/thread.html/9be975c53e5ad612c7e0af39f5b88837fbfbc32108e587d3d8499844@%3Cdev.mesos.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-p2xq-vcm7-xjj6 · Aviso do Fabricante
• https://lists.apache.org/thread.html/9be975c53e5ad612c7e0af39f5b88837fbfbc32108e587d3d8499844%40%3Cdev.mesos.apache.org%3E · Nota