CVE-2018-11793: Buffer Overflow
First published: Tue Mar 05 2019(Updated: )
When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Mesos | >=1.4.0<1.4.3 | |
| Apache Mesos | >=1.5.0<1.5.2 | |
| Apache Mesos | >=1.6.0<1.6.2 | |
| Apache Mesos | >=1.7.0<1.7.1 | |
| Apache Mesos | =1.4.0-rc1 | |
| Apache Mesos | =1.4.0-rc2 | |
| Apache Mesos | =1.4.0-rc3 | |
| Apache Mesos | =1.4.0-rc4 | |
| Apache Mesos | =1.4.0-rc5 | |
| Apache Mesos | =1.8.0-dev |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Apache Mesos vulnerability?
The vulnerability ID for this Apache Mesos vulnerability is CVE-2018-11793.
What is the severity level of CVE-2018-11793?
CVE-2018-11793 has a severity level of 7.5 (high).
Which versions of Apache Mesos are affected by CVE-2018-11793?
Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 are affected by CVE-2018-11793.
How can a malicious actor exploit CVE-2018-11793?
A malicious actor can exploit CVE-2018-11793 by parsing a JSON payload with deeply nested JSON structures, causing unbounded recursion and a denial of service attack.
Are there any references related to CVE-2018-11793?
Yes, you can find more information about CVE-2018-11793 at the following references: [1] http://www.securityfocus.com/bid/107281 [2] https://lists.apache.org/thread.html/9be975c53e5ad612c7e0af39f5b88837fbfbc32108e587d3d8499844@%3Cdev.mesos.apache.org%3E
- collector/nvd-index
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/type
- agent/tags
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/apache
- canonical/apache mesos
- version/apache mesos/1.4.0
- version/apache mesos/1.5.0
- version/apache mesos/1.6.0
- version/apache mesos/1.7.0
- version/apache mesos/1.4.0-rc1
- version/apache mesos/1.4.0-rc2
- version/apache mesos/1.4.0-rc3
- version/apache mesos/1.4.0-rc4
- version/apache mesos/1.4.0-rc5
- version/apache mesos/1.8.0-dev