CVE-2018-1330

When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

Score

CVSS 3.0 7.5 High

Status

Modified - security@apache.org

Published

2018-09-13

Last modified

2024-09-16

Weaknesses

CWE-20

Affected products

• Mesos (Apache)
• Apache Mesos (Apache Software Foundation)

References

• https://lists.apache.org/thread.html/395cb6bcf367702acd1e580a1f39b56cdd7a5953d0368b4c1adb1dde%40%3Cdev.mesos.apache.org…