CVE-2018-11793

CWE-119 — Buffer OverflowCWE-121 — Stack-based Buffer Overflow7 documents6 sources
Severity
7.5HIGH
EPSS
7.4%
top 8.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache MesosApache Software Foundation Apache Mesos
Timeline
PublishedMar 5
Latest updateMar 11

Description

When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/mesos1.4.0 — 1.4.3+5
▶Mavenorg.apache.mesos:mesos1.5.0 — 1.5.2+3
▶CVEListV5apache_software_foundation/apache_mesosApache Mesos pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, 1.7.0

🔴Vulnerability Details

3
GHSA
Stack Overflow in Apache Mesos↗2019-03-06
▶
OSV
Stack Overflow in Apache Mesos↗2019-03-06
▶
CVEList
CVE-2018-11793: When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1↗2019-03-05
▶

📋Vendor Advisories

1
Red Hat
mesos: stack overflow vulnerability in parser↗2019-03-04
▶

💬Community

2
Bugzilla
CVE-2018-11793 mesos: stack overflow vulnerability in parser [fedora-all]↗2019-03-11
▶
Bugzilla
CVE-2018-11793 mesos: stack overflow vulnerability in parser↗2019-03-11
▶
CVE-2018-11793 (HIGH CVSS 7.5) | When parsing a JSON payload with de | cvebase.io