Not rated
CVE-2018-8023 Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT)
Description
Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Mesos | 1.6.0 | No fix stated |
References
Timeline
- Published
- Last modified
Other CVEs of Apache Mesos
The 5 CVEs of Apache Mesos →
CVE-2018-11793
When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0…
Not rated
CVE-2018-1330
When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught…
Not rated
CVE-2017-7687
When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3,…
Not rated
CVE-2017-9790
When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before…
Not rated