CVE-2018-1330: Input Validation
When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-1330?
CVE-2018-1330 is a vulnerability that affects Apache Mesos versions 1.4.0 to 1.5.0 and allows a malicious actor to cause a denial of service (crash) by sending a malformed JSON payload.
How does CVE-2018-1330 affect Apache Mesos?
CVE-2018-1330 affects Apache Mesos versions 1.4.0 to 1.5.0 by causing a crash in libprocess when parsing a malformed JSON payload or chunked HTTP requests with trailers.
What is the severity of CVE-2018-1330?
CVE-2018-1330 has a severity rating of 7.5 (high).
How can CVE-2018-1330 be exploited?
CVE-2018-1330 can be exploited by a malicious actor sending a malformed JSON payload or chunked HTTP requests with trailers to Apache Mesos.
Is there a fix for CVE-2018-1330?
Yes, upgrading to Apache Mesos versions 1.5.1 or later resolves the vulnerability.