PT-2017-19189 · Apache · Apache Mesos

Published 2017-09-28 · Updated 2022-05-13 · CVE-2017-9790

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Mesos versions prior to 1.1.3 Apache Mesos versions 1.2.x prior to 1.2.2 Apache Mesos versions 1.3.x prior to 1.3.1 Apache Mesos version 1.4.0-dev

Description The issue occurs when handling a libprocess message wrapped in an HTTP request. If the request path is empty, it causes a crash because the parser assumes the request path always starts with '/'. A malicious actor can exploit this to cause a denial of service, rendering the Mesos-controlled cluster inoperable.

Recommendations For Apache Mesos versions prior to 1.1.3, update to version 1.1.3 or later. For Apache Mesos versions 1.2.x prior to 1.2.2, update to version 1.2.2 or later. For Apache Mesos versions 1.3.x prior to 1.3.1, update to version 1.3.1 or later. For Apache Mesos version 1.4.0-dev, update to a stable version that includes the fix.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2017-9790

GHSA-VPCV-78CP-WHR3

Affected Products

Apache Mesos

References · 6

• https://osv.dev/vulnerability/GHSA-vpcv-78cp-whr3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9790 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9790 · Vendor Advisory
• http://securityfocus.com/bid/101023 · Note
• https://lists.apache.org/thread.html/cc1e7a69ea78da0511f5b54b6be7aa6e3c78edad5aaff430e7de028b%40%3Cdev.mesos.apache.org%3E · Note
• https://lists.apache.org/thread.html/cc1e7a69ea78da0511f5b54b6be7aa6e3c78edad5aaff430e7de028b@%3Cdev.mesos.apache.org%3E · Note