GHSA-vpcv-78cp-whr3

Suggest an improvement
Source
https://github.com/advisories/GHSA-vpcv-78cp-whr3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vpcv-78cp-whr3/GHSA-vpcv-78cp-whr3.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-vpcv-78cp-whr3
Aliases
Published
2022-05-13T01:48:07Z
Modified
2023-11-01T04:48:26.302863Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Use after free in Apache Mesos
Details

When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

Database specific 
{
    "cwe_ids": [
        "CWE-416"
    ],
    "nvd_published_at": "2017-09-29T01:34:00Z",
    "github_reviewed_at": "2022-11-01T22:59:03Z",
    "github_reviewed": true,
    "severity": "HIGH"
}
References

Affected packages

Maven / org.apache.mesos:mesos

Package

Name
org.apache.mesos:mesos
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mesos/mesos

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.3

Affected versions

0.*

0.9.0-incubating
0.10.0-incubating
0.11.0-incubating
0.12.0-incubating
0.12.1
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0-rc3
0.15.0-rc4
0.15.0
0.16.0-rc4
0.16.0-rc5
0.16.0
0.17.0-rc1
0.17.0-rc2
0.17.0
0.18.0-rc1
0.18.0-rc2
0.18.0-rc3
0.18.0-rc4
0.18.0-rc5
0.18.0-rc6
0.18.0
0.18.1-rc1
0.18.1-rc2
0.18.1
0.18.2-rc1
0.18.2
0.19.0-rc3
0.19.0
0.19.1-rc1
0.19.1
0.20.0-rc1
0.20.0-rc2
0.20.0
0.20.1-rc1
0.20.1-rc2
0.20.1-rc3
0.20.1
0.21.0-rc1
0.21.0-rc2
0.21.0-rc3
0.21.0
0.21.1-rc1
0.21.1-rc2
0.21.1
0.21.2-rc1
0.21.2
0.22.0-rc4
0.22.0
0.22.1-rc5
0.22.1-rc6
0.22.1
0.22.2-rc1
0.22.2
0.23.0-rc1
0.23.0-rc2
0.23.0-rc3
0.23.0-rc4
0.23.0
0.23.1-rc1
0.23.1
0.24.0-rc1
0.24.0-rc2
0.24.0
0.24.1-rc1
0.24.1
0.24.2-rc1
0.24.2-rc2
0.24.2-rc3
0.24.2-rc4
0.24.2-rc5
0.24.2
0.25.0-rc1
0.25.0-rc2
0.25.0-rc3
0.25.0
0.25.1-rc1
0.25.1-rc2
0.25.1-rc3
0.25.1-rc4
0.25.1
0.26.0-rc1
0.26.0-rc2
0.26.0-rc3
0.26.0-rc4
0.26.0-rc5
0.26.0
0.26.1-rc1
0.26.1-rc2
0.26.1-rc3
0.26.1-rc4
0.26.1
0.26.2-rc1
0.26.2
0.27.0-rc1
0.27.0-rc2
0.27.0
0.27.1-rc1
0.27.1
0.27.2-rc1
0.27.2
0.27.3-rc1
0.27.3
0.28.0-rc1
0.28.0-rc2
0.28.0
0.28.1-rc1
0.28.1-rc2
0.28.1
0.28.2-rc1
0.28.2
0.28.3-rc1
0.28.3

1.*

1.0.0-rc1
1.0.0-rc2
1.0.0-rc3
1.0.0-rc4
1.0.0
1.0.1-rc1
1.0.1
1.0.2-rc1
1.0.2-rc2
1.0.2-rc3
1.0.2
1.0.3-rc1
1.0.3-rc2
1.0.3
1.0.4-rc1
1.0.4-rc2
1.0.4
1.1.0-rc1
1.1.0-rc2
1.1.0-rc3
1.1.0
1.1.1-rc1
1.1.1-rc2
1.1.1
1.1.2-rc1
1.1.2-rc2
1.1.2
1.1.3-rc1
1.1.3-rc2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vpcv-78cp-whr3/GHSA-vpcv-78cp-whr3.json"

Maven / org.apache.mesos:mesos

Package

Name
org.apache.mesos:mesos
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mesos/mesos

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.2.0
Fixed
1.2.2

Affected versions

1.*

1.2.0
1.2.1-rc1
1.2.1
1.2.2-rc1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vpcv-78cp-whr3/GHSA-vpcv-78cp-whr3.json"

Maven / org.apache.mesos:mesos

Package

Name
org.apache.mesos:mesos
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mesos/mesos

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.3.0
Fixed
1.3.1

Affected versions

1.*

1.3.0
1.3.1-rc1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vpcv-78cp-whr3/GHSA-vpcv-78cp-whr3.json"