CVE-2018-1330

Published: Sep 13, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

Affected (8)

Products: Apache: Mesos

Apache

1 product

Mesos

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Apache Mesos	From 1.4.0 to 1.4.2
Apache Mesos	From 1.5.0 to 1.5.1
Apache Mesos	Version 1.4.0 rc1
Apache Mesos	Version 1.4.0 rc2
Apache Mesos	Version 1.4.0 rc3
Apache Mesos	Version 1.4.0 rc4
Apache Mesos	Version 1.4.0 rc5
Apache Mesos	Version 1.6.0 rc1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://lists.apache.org/thread.html/395cb6bcf367702acd1e580a1f39b56cdd7a5953d0368b4c1adb1dde%40%3Cdev.mesos.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/395cb6bcf367702acd1e580a1f39b56cdd7a5953d0368b4c1adb1dde%40%3Cdev.mesos.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.