PT-2018-11726 · Apache · Apache Mesos

Published 2018-09-13 · Updated 2022-05-14 · CVE-2018-1330

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Mesos versions 1.4.0 through 1.5.0

Description The issue arises when parsing a malformed JSON payload, which can cause libprocess in Apache Mesos to crash due to an uncaught exception. Additionally, parsing chunked HTTP requests with trailers can lead to a libprocess crash because of a mistakenly planted assertion. This can be exploited by a malicious actor to cause a denial of service, rendering the Mesos-controlled cluster inoperable.

Recommendations For Apache Mesos versions 1.4.0 through 1.5.0, update to a version that fixes the issue with parsing malformed JSON payloads and chunked HTTP requests to prevent denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-248

CWE-20

Related Identifiers

CVE-2018-1330

GHSA-95Q3-PPPP-R683

Affected Products

Apache Mesos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-1330 · Security Note
• https://osv.dev/vulnerability/GHSA-95q3-pppp-r683 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1330 · Vendor Advisory
• https://lists.apache.org/thread.html/395cb6bcf367702acd1e580a1f39b56cdd7a5953d0368b4c1adb1dde%40%3Cdev.mesos.apache.org%3E · Note
• https://lists.apache.org/thread.html/395cb6bcf367702acd1e580a1f39b56cdd7a5953d0368b4c1adb1dde@%3Cdev.mesos.apache.org%3E · Note