CVE-2017-9790 Use after free in Apache Mesos
HighCVSS 7.5
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.mesos/mesos(Maven) | < 1.1.3 | 1.1.3 |
| org.apache.mesos/mesos(Maven) | >= 1.2.0, < 1.2.2 | 1.2.2 |
| org.apache.mesos/mesos(Maven) | >= 1.3.0, < 1.3.1 | 1.3.1 |
| org.apache.mesos/mesos(Maven) | = 0.10.0-incubating | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.11.0-incubating | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.12.0-incubating | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.12.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.13.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.14.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.14.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.14.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.15.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.15.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.15.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.16.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.16.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.16.0-rc5 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.17.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.17.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.17.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc4 | No fix listed |
Show 139 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc5 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc6 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.19.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.19.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.19.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.19.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.1-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.1-rc5 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.1-rc6 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2-rc5 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.1-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.1-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0-rc5 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.1-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.1-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.3-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.3-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.9.0-incubating | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.2-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.2-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.3-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.3-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.4-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.4-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.2-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.3-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.3-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.3.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.3.1-rc1 | No fix listed |
| apache mesos | <= 1.1.2 | No fix listed |
| apache mesos | = 1.2.0 | No fix listed |
| apache mesos | = 1.2.1 | No fix listed |
| apache mesos | = 1.3.0 | No fix listed |
| apache mesos | = 1.3.1 | No fix listed |
| apache mesos | = 1.4.0-dev | No fix listed |
| Apache Mesos | = versions prior to 1.1.3 | No fix listed |
| Apache Mesos | = 1.2.x before 1.2.2 | No fix listed |
| Apache Mesos | = 1.3.x before 1.3.1 | No fix listed |
| Apache Mesos | = 1.4.0-dev | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- lists.apache.org
- 101023 third-party-advisory vdb-entry
- github.com
- [dev] 20170926 CVE-2017-9790: Libprocess might crash when decoding an HTTP request with absent path. mailing-list