CVE-2018-11793 Stack Overflow in Apache Mesos

What is CVE-2018-11793?

CVE-2018-11793 is a high-severity denial of service vulnerability in Apache Mesos, published on 5 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

Weakness: CWE-119

Which versions are affected by CVE-2018-11793?

8 open source packages ship an affected version, including org.apache.mesos:mesos. It affects 1 product.

Products include Apache Mesos.

How do I fix CVE-2018-11793?

Upgrade org.apache.mesos:mesos to a fixed version for your release line: 1.4.3, 1.5.2, 1.6.2 or 1.7.1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-11793 being exploited?

There is no known exploitation of CVE-2018-11793 in the wild and no public exploit code.

Other vulnerabilities in Apache Mesos

• CVE-2019-5736 Privilege escalation in n/a High 8.6
• CVE-2019-0204 Docker image code execution with Apache Mesos High 7.8
• CVE-2018-1330 Crash when decoding malformed HTTP requests or malformed JSON payload High 7.5
• CVE-2017-7687 Denial of service in Apache Mesos High 7.5
• CVE-2017-9790 Use after free in Apache Mesos High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p2xq-vcm7-xjj6.