GHSA-c8cc-p3j7-4c7f

Suggest an improvement
Source
https://github.com/advisories/GHSA-c8cc-p3j7-4c7f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-c8cc-p3j7-4c7f/GHSA-c8cc-p3j7-4c7f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-c8cc-p3j7-4c7f
Aliases
Published
2018-10-17T19:54:14Z
Modified
2023-11-08T04:00:24.364977Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Moderate severity vulnerability that affects org.apache.mesos:mesos
Details

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard == operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.

Database specific 
{
    "nvd_published_at": null,
    "github_reviewed_at": "2020-06-16T21:30:32Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Maven / org.apache.mesos:mesos

Package

Name
org.apache.mesos:mesos
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mesos/mesos

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.2

Affected versions

0.*

0.9.0-incubating
0.10.0-incubating
0.11.0-incubating
0.12.0-incubating
0.12.1
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0-rc3
0.15.0-rc4
0.15.0
0.16.0-rc4
0.16.0-rc5
0.16.0
0.17.0-rc1
0.17.0-rc2
0.17.0
0.18.0-rc1
0.18.0-rc2
0.18.0-rc3
0.18.0-rc4
0.18.0-rc5
0.18.0-rc6
0.18.0
0.18.1-rc1
0.18.1-rc2
0.18.1
0.18.2-rc1
0.18.2
0.19.0-rc3
0.19.0
0.19.1-rc1
0.19.1
0.20.0-rc1
0.20.0-rc2
0.20.0
0.20.1-rc1
0.20.1-rc2
0.20.1-rc3
0.20.1
0.21.0-rc1
0.21.0-rc2
0.21.0-rc3
0.21.0
0.21.1-rc1
0.21.1-rc2
0.21.1
0.21.2-rc1
0.21.2
0.22.0-rc4
0.22.0
0.22.1-rc5
0.22.1-rc6
0.22.1
0.22.2-rc1
0.22.2
0.23.0-rc1
0.23.0-rc2
0.23.0-rc3
0.23.0-rc4
0.23.0
0.23.1-rc1
0.23.1
0.24.0-rc1
0.24.0-rc2
0.24.0
0.24.1-rc1
0.24.1
0.24.2-rc1
0.24.2-rc2
0.24.2-rc3
0.24.2-rc4
0.24.2-rc5
0.24.2
0.25.0-rc1
0.25.0-rc2
0.25.0-rc3
0.25.0
0.25.1-rc1
0.25.1-rc2
0.25.1-rc3
0.25.1-rc4
0.25.1
0.26.0-rc1
0.26.0-rc2
0.26.0-rc3
0.26.0-rc4
0.26.0-rc5
0.26.0
0.26.1-rc1
0.26.1-rc2
0.26.1-rc3
0.26.1-rc4
0.26.1
0.26.2-rc1
0.26.2
0.27.0-rc1
0.27.0-rc2
0.27.0
0.27.1-rc1
0.27.1
0.27.2-rc1
0.27.2
0.27.3-rc1
0.27.3
0.28.0-rc1
0.28.0-rc2
0.28.0
0.28.1-rc1
0.28.1-rc2
0.28.1
0.28.2-rc1
0.28.2
0.28.3-rc1
0.28.3

1.*

1.0.0-rc1
1.0.0-rc2
1.0.0-rc3
1.0.0-rc4
1.0.0
1.0.1-rc1
1.0.1
1.0.2-rc1
1.0.2-rc2
1.0.2-rc3
1.0.2
1.0.3-rc1
1.0.3-rc2
1.0.3
1.0.4-rc1
1.0.4-rc2
1.0.4
1.1.0-rc1
1.1.0-rc2
1.1.0-rc3
1.1.0
1.1.1-rc1
1.1.1-rc2
1.1.1
1.1.2-rc1
1.1.2-rc2
1.1.2
1.1.3-rc1
1.1.3-rc2
1.1.3
1.2.0-rc1
1.2.0-rc2
1.2.0
1.2.1-rc1
1.2.1
1.2.2-rc1
1.2.2
1.2.3-rc1
1.2.3
1.3.0-rc1
1.3.0-rc2
1.3.0-rc3
1.3.0
1.3.1-rc1
1.3.1
1.3.2-rc1
1.3.2
1.3.3-rc1
1.4.0-rc1
1.4.0-rc2
1.4.0-rc3
1.4.0
1.4.1

Maven / org.apache.mesos:mesos

Package

Name
org.apache.mesos:mesos
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mesos/mesos

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.5.0
Fixed
1.5.2

Affected versions

1.*

1.5.0

Maven / org.apache.mesos:mesos

Package

Name
org.apache.mesos:mesos
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mesos/mesos

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.6.0
Fixed
1.6.1

Affected versions

1.*

1.6.0