CVE-2018-1330

CWE-20 — Improper Input ValidationCWE-2486 documents5 sources
Severity
7.5HIGH
EPSS
0.8%
top 25.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache MesosApache Software Foundation Apache Mesos
Timeline
PublishedSep 13
Latest updateMay 14

Description

When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/mesos1.4.0 — 1.4.2+3
▶Mavenorg.apache.mesos:mesos1.4.0 — 1.6.0
▶CVEListV5apache_software_foundation/apache_mesos1.4.0 to 1.5.0

🔴Vulnerability Details

3
OSV
Crash when decoding malformed HTTP requests or malformed JSON payload↗2022-05-14
▶
GHSA
Crash when decoding malformed HTTP requests or malformed JSON payload↗2022-05-14
▶
CVEList
CVE-2018-1330: When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1↗2018-09-13
▶

💬Community

2
Bugzilla
CVE-2018-1330 mesos: Libprocess crashes when decoding malformed HTTP requests or malformed JSON payload↗2018-09-17
▶
Bugzilla
CVE-2018-1330 mesos: Libprocess crashes when decoding malformed HTTP requests or malformed JSON payload [fedora-all]↗2018-09-17
▶
CVE-2018-1330 (HIGH CVSS 7.5) | When parsing a malformed JSON paylo | cvebase.io