CVE-2017-9790: Use After Free
When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9790?
CVE-2017-9790 is considered to be of moderate severity as it can lead to crashes in Apache Mesos.
How do I fix CVE-2017-9790?
To fix CVE-2017-9790, you should upgrade to Apache Mesos version 1.1.3 or later, 1.2.2 or later, 1.3.1 or later, or avoid using version 1.4.0-dev.
Which versions of Apache Mesos are affected by CVE-2017-9790?
CVE-2017-9790 affects Apache Mesos versions prior to 1.1.3, 1.2.2, 1.3.1, and 1.4.0-dev.
Can CVE-2017-9790 be exploited remotely?
Yes, CVE-2017-9790 can be exploited by remote attackers who can send specially crafted HTTP requests.
What is the impact of CVE-2017-9790 on Apache Mesos?
The impact of CVE-2017-9790 is a denial of service condition due to crashing when handling improperly formatted HTTP requests.