CVE-2018-8023 Moderate severity vulnerability that affects org.apache.mesos:mesos
MediumCVSS 5.9
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard == operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.mesos/mesos(Maven) | < 1.4.2 | 1.4.2 |
| org.apache.mesos/mesos(Maven) | >= 1.5.0, < 1.5.2 | 1.5.2 |
| org.apache.mesos/mesos(Maven) | >= 1.6.0, < 1.6.1 | 1.6.1 |
| org.apache.mesos/mesos(Maven) | = 0.10.0-incubating | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.11.0-incubating | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.12.0-incubating | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.12.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.13.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.14.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.14.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.14.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.15.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.15.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.15.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.16.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.16.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.16.0-rc5 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.17.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.17.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.17.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc4 | No fix listed |
Show 156 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc5 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.0-rc6 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.18.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.19.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.19.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.19.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.19.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.20.1-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.21.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.1-rc5 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.1-rc6 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.22.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.23.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.24.2-rc5 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.1-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.25.1-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.0-rc5 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.1-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.1-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.26.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.27.3-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.28.3-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 0.9.0-incubating | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.0-rc4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.2-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.2-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.3-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.3-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.4 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.4-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.0.4-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.1-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.2-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.3-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.1.3-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.2.3-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.3.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.3.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.3.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.3.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.3.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.3.1-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.3.2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.3.2-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.3.3-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.4.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.4.0-rc1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.4.0-rc2 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.4.0-rc3 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.4.1 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.5.0 | No fix listed |
| org.apache.mesos/mesos(Maven) | = 1.6.0 | No fix listed |
| apache mesos | < 1.4.2 | 1.4.2 |
| apache mesos | = 1.5.0 | No fix listed |
| apache mesos | = 1.5.1 | No fix listed |
| apache mesos | = 1.6.0 | No fix listed |
| Apache Mesos | = versions prior to 1.4.2 | No fix listed |
| Apache Mesos | = 1.5.0, 1.5.1 | No fix listed |
| Apache Mesos | = 1.6.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- lists.apache.org
- lists.apache.org
- [dev] 20180921 CVE-2018-8023: A remote attacker can exploit a vulnerability in the JWT implementation to gain unauthenticated access to Mesos Executor HTTP API. mailing-list
- [flink-user] 20201022 Dependency vulnerabilities with flink 1.11.1 version mailing-list