GitHub Advisoryadvisory · Maven

GHSA-95q3-pppp-r683 Crash when decoding malformed HTTP requests or malformed JSON payload

HIGH Published 2022-05-14 Modified 2022-11-01 Official page ↗
Aliases
CVE-2018-1330
Ecosystem
Maven
Packages
org.apache.mesos:mesos
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-248
Reviewed
2022-11-01

Affected packages

• Maven org.apache.mesos:mesos: >= 1.4.0, < 1.6.0 → fixed in 1.6.0

Description

When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

Related

Alias · CVE (1)

  • CVE-2018-1330 When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. vulnerability

Weakness · CWE (1)

  • CWE-248 Uncaught Exception weakness

References