CVE-2018-8023: Apache Mesos JWT Authentication Timing Attack
Summary
CVE-2018-8023: Moderate severity vulnerability that affects org.apache.mesos:mesos. Affects org.apache.mesos:mesos across 3 version ranges.
< 1.4.2
>= 1.5.0, < 1.5.2
>= 1.6.0, < 1.6.1
Fixed in 1.4.2, 1.5.2 or 1.6.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Mesos is an open-source cluster manager that provides efficient resource isolation and sharing across distributed applications. It allows users to run tasks on a cluster of machines, providing fault-tolerance and scalability. The package 'org.apache.mesos:mesos' is a Maven package for Apache Mesos. This vulnerability affects versions pre-1.4.2, 1.5.0, 1.5.1, and 1.6.0 of Apache Mesos.
Vulnerability Detail
The vulnerability in Apache Mesos lies in its JSON Web Token (JWT) implementation used for authentication in the Executor HTTP API. The comparison of the generated HMAC value against the provided signature is vulnerable to a timing attack. Instead of using a constant-time string comparison routine, a standard '==' operator has been used. This timing difference can be exploited by a malicious actor to reveal the correct HMAC value. This vulnerability has a CVSS score of 5.9, indicating a moderate severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.4.21.4.2 -
>= 1.5.0, < 1.5.21.5.2 -
>= 1.6.0, < 1.6.11.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, and 1.6.0 are vulnerable to a timing attack in the JSON Web Token (JWT) implementation used for authentication in the Executor HTTP API. It is recommended to update to the fixed versions mentioned above to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.mesos:mesos →
FAQ
Apache Mesos is an open-source cluster manager that provides efficient resource isolation and sharing across distributed applications.
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. It is commonly used for authentication and authorization purposes.
A timing attack is a type of side-channel attack where an attacker measures the time taken by a system to perform certain operations to gain information about secret values.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.mesos:mesos.
