CVE-2018-1330: Apache Mesos - Crash when decoding malformed HTTP requests or malformed JSON payload
Summary
CVE-2018-1330: Crash when decoding malformed HTTP requests or malformed JSON payload. Affects org.apache.mesos:mesos versions >= 1.4.0, < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Mesos is an open-source cluster manager that provides efficient resource isolation and sharing across distributed applications. It allows users to run multiple frameworks on a shared pool of resources, providing fault-tolerance and scalability. The vulnerability affects versions 1.4.0 to 1.5.0 of the Mesos package.
Vulnerability Detail
The vulnerability in Apache Mesos arises when parsing a malformed JSON payload or chunked HTTP requests with trailers. In the case of a malformed JSON payload, the libprocess component of Mesos may crash due to an uncaught exception. Similarly, parsing chunked HTTP requests with trailers can trigger a libprocess crash because of a mistakenly planted assertion. Exploiting this vulnerability, a malicious actor can cause a denial of service (DoS) attack on Mesos masters, rendering the Mesos-controlled cluster inoperable. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of Apache Mesos.
Conclusion
The vulnerability in Apache Mesos, CVE-2018-1330, can lead to a denial of service (DoS) attack on Mesos masters. It is crucial for users to upgrade their Mesos installations to version 1.6.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.mesos:mesos →
FAQ
Apache Mesos is an open-source cluster manager that provides efficient resource isolation and sharing across distributed applications. It allows users to run multiple frameworks on a shared pool of resources, providing fault-tolerance and scalability.
Versions 1.4.0 to 1.5.0 of Apache Mesos are affected by this vulnerability.
This vulnerability can be exploited by a malicious actor to cause a denial of service (DoS) attack on Mesos masters, rendering the Mesos-controlled cluster inoperable.
Yes, upgrading to Apache Mesos version 1.6.0 or later includes the necessary patches and fixes to address this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched version of Apache Mesos.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.mesos:mesos.
