CVE-2018-11793

Published: Mar 5, 2019Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

Affected (10)

Products: Apache: Mesos

Apache

1 product

Mesos

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Apache Mesos	1.4.0 ≤ version < 1.4.3
Apache Mesos	1.5.0 ≤ version < 1.5.2
Apache Mesos	1.6.0 ≤ version < 1.6.2
Apache Mesos	1.7.0 ≤ version < 1.7.1
Apache Mesos	Version 1.4.0 rc1
Apache Mesos	Version 1.4.0 rc2
Apache Mesos	Version 1.4.0 rc3
Apache Mesos	Version 1.4.0 rc4
Apache Mesos	Version 1.4.0 rc5
Apache Mesos	Version 1.8.0 dev

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (4)

http://www.securityfocus.com/bid/107281

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://lists.apache.org/thread.html/9be975c53e5ad612c7e0af39f5b88837fbfbc32108e587d3d8499844%40%3Cdev.mesos.apache.org%3E

Source: security@apache.org

http://www.securityfocus.com/bid/107281

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://lists.apache.org/thread.html/9be975c53e5ad612c7e0af39f5b88837fbfbc32108e587d3d8499844%40%3Cdev.mesos.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.