GHSA-p2xq-vcm7-xjj6

Suggest an improvement
Source
https://github.com/advisories/GHSA-p2xq-vcm7-xjj6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-p2xq-vcm7-xjj6/GHSA-p2xq-vcm7-xjj6.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-p2xq-vcm7-xjj6
Aliases
Published
2019-03-06T17:36:22Z
Modified
2023-11-01T04:48:50.468588Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Stack Overflow in Apache Mesos
Details

When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

Database specific 
{
    "nvd_published_at": null,
    "github_reviewed_at": "2020-06-16T21:47:49Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-119"
    ]
}
References

Affected packages

Maven / org.apache.mesos:mesos

Package

Name
org.apache.mesos:mesos
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mesos/mesos

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.3

Affected versions

0.*

0.9.0-incubating
0.10.0-incubating
0.11.0-incubating
0.12.0-incubating
0.12.1
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0-rc3
0.15.0-rc4
0.15.0
0.16.0-rc4
0.16.0-rc5
0.16.0
0.17.0-rc1
0.17.0-rc2
0.17.0
0.18.0-rc1
0.18.0-rc2
0.18.0-rc3
0.18.0-rc4
0.18.0-rc5
0.18.0-rc6
0.18.0
0.18.1-rc1
0.18.1-rc2
0.18.1
0.18.2-rc1
0.18.2
0.19.0-rc3
0.19.0
0.19.1-rc1
0.19.1
0.20.0-rc1
0.20.0-rc2
0.20.0
0.20.1-rc1
0.20.1-rc2
0.20.1-rc3
0.20.1
0.21.0-rc1
0.21.0-rc2
0.21.0-rc3
0.21.0
0.21.1-rc1
0.21.1-rc2
0.21.1
0.21.2-rc1
0.21.2
0.22.0-rc4
0.22.0
0.22.1-rc5
0.22.1-rc6
0.22.1
0.22.2-rc1
0.22.2
0.23.0-rc1
0.23.0-rc2
0.23.0-rc3
0.23.0-rc4
0.23.0
0.23.1-rc1
0.23.1
0.24.0-rc1
0.24.0-rc2
0.24.0
0.24.1-rc1
0.24.1
0.24.2-rc1
0.24.2-rc2
0.24.2-rc3
0.24.2-rc4
0.24.2-rc5
0.24.2
0.25.0-rc1
0.25.0-rc2
0.25.0-rc3
0.25.0
0.25.1-rc1
0.25.1-rc2
0.25.1-rc3
0.25.1-rc4
0.25.1
0.26.0-rc1
0.26.0-rc2
0.26.0-rc3
0.26.0-rc4
0.26.0-rc5
0.26.0
0.26.1-rc1
0.26.1-rc2
0.26.1-rc3
0.26.1-rc4
0.26.1
0.26.2-rc1
0.26.2
0.27.0-rc1
0.27.0-rc2
0.27.0
0.27.1-rc1
0.27.1
0.27.2-rc1
0.27.2
0.27.3-rc1
0.27.3
0.28.0-rc1
0.28.0-rc2
0.28.0
0.28.1-rc1
0.28.1-rc2
0.28.1
0.28.2-rc1
0.28.2
0.28.3-rc1
0.28.3

1.*

1.0.0-rc1
1.0.0-rc2
1.0.0-rc3
1.0.0-rc4
1.0.0
1.0.1-rc1
1.0.1
1.0.2-rc1
1.0.2-rc2
1.0.2-rc3
1.0.2
1.0.3-rc1
1.0.3-rc2
1.0.3
1.0.4-rc1
1.0.4-rc2
1.0.4
1.1.0-rc1
1.1.0-rc2
1.1.0-rc3
1.1.0
1.1.1-rc1
1.1.1-rc2
1.1.1
1.1.2-rc1
1.1.2-rc2
1.1.2
1.1.3-rc1
1.1.3-rc2
1.1.3
1.2.0-rc1
1.2.0-rc2
1.2.0
1.2.1-rc1
1.2.1
1.2.2-rc1
1.2.2
1.2.3-rc1
1.2.3
1.3.0-rc1
1.3.0-rc2
1.3.0-rc3
1.3.0
1.3.1-rc1
1.3.1
1.3.2-rc1
1.3.2
1.3.3-rc1
1.4.0-rc1
1.4.0-rc2
1.4.0-rc3
1.4.0
1.4.1
1.4.2

Maven / org.apache.mesos:mesos

Package

Name
org.apache.mesos:mesos
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mesos/mesos

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.5.0
Fixed
1.5.2

Affected versions

1.*

1.5.0

Maven / org.apache.mesos:mesos

Package

Name
org.apache.mesos:mesos
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mesos/mesos

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.6.0
Fixed
1.6.2

Affected versions

1.*

1.6.0
1.6.1

Maven / org.apache.mesos:mesos

Package

Name
org.apache.mesos:mesos
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mesos/mesos

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.7.0
Fixed
1.7.1

Affected versions

1.*

1.7.0
1.7.1-rc1