CVE-2018-8023: Infoleak
Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard == operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-8023?
CVE-2018-8023 is a vulnerability in Apache Mesos that allows an attacker to bypass authentication and call the Executor HTTP API using JSON Web Token (JWT) in certain versions of Apache Mesos.
How severe is CVE-2018-8023?
CVE-2018-8023 has a severity level of 5.9 out of 10.
How does CVE-2018-8023 affect Apache Mesos?
CVE-2018-8023 affects Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, and 1.6.0.
How can an attacker exploit CVE-2018-8023?
An attacker can exploit CVE-2018-8023 by bypassing authentication and calling the Executor HTTP API using JSON Web Token (JWT) in affected versions of Apache Mesos.
Is there a fix available for CVE-2018-8023?
Yes, upgrading to Apache Mesos version 1.6.1 or later can fix the CVE-2018-8023 vulnerability.