Vulnerability Details : CVE-2018-1330
When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2018-1330
- cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:mesos:1.4.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:apache:mesos:1.4.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:apache:mesos:1.4.0:rc5:*:*:*:*:*:*
- cpe:2.3:a:apache:mesos:1.4.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:apache:mesos:1.4.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:apache:mesos:1.6.0:rc1:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-1330
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 34 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-1330
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2018-1330
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-1330
-
https://lists.apache.org/thread.html/395cb6bcf367702acd1e580a1f39b56cdd7a5953d0368b4c1adb1dde@<dev.mesos.apache.org>
CVE-2018-1330: Libprocess might crash when decoding malformed HTTP requests or malformed JSON payload. - Pony MailMailing List;Vendor Advisory
Jump to