CVE-2018-8023: Infoleak
First published: Fri Sep 21 2018(Updated: )
Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Mesos | <1.4.2 | |
| Apache Mesos | =1.5.0 | |
| Apache Mesos | =1.5.1 | |
| Apache Mesos | =1.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/9b9d3f6bd09f3ebd2284b82077033bdc71da550a1c4c010c2494acc3@%3Cdev.mesos.apache.org%3E
- https://lists.apache.org/thread.html/r0dd7ff197b2e3bdd80a0326587ca3d0c22e10d1dba17c769d6da7d7a@%3Cuser.flink.apache.org%3E
- https://lists.apache.org/thread.html/9b9d3f6bd09f3ebd2284b82077033bdc71da550a1c4c010c2494acc3%40%3Cdev.mesos.apache.org%3E
- https://lists.apache.org/thread.html/r0dd7ff197b2e3bdd80a0326587ca3d0c22e10d1dba17c769d6da7d7a%40%3Cuser.flink.apache.org%3E
Frequently Asked Questions
What is CVE-2018-8023?
CVE-2018-8023 is a vulnerability in Apache Mesos that allows an attacker to bypass authentication and call the Executor HTTP API using JSON Web Token (JWT) in certain versions of Apache Mesos.
How severe is CVE-2018-8023?
CVE-2018-8023 has a severity level of 5.9 out of 10.
How does CVE-2018-8023 affect Apache Mesos?
CVE-2018-8023 affects Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, and 1.6.0.
How can an attacker exploit CVE-2018-8023?
An attacker can exploit CVE-2018-8023 by bypassing authentication and calling the Executor HTTP API using JSON Web Token (JWT) in affected versions of Apache Mesos.
Is there a fix available for CVE-2018-8023?
Yes, upgrading to Apache Mesos version 1.6.1 or later can fix the CVE-2018-8023 vulnerability.
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/type
- agent/last-modified-date
- agent/event
- agent/description
- agent/tags
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/apache
- canonical/apache mesos
- version/apache mesos/1.5.0
- version/apache mesos/1.5.1
- version/apache mesos/1.6.0