CVE-2018-8023
Moderate severity vulnerability that affects org.apache.mesos:mesos
5.9
MEDIUM
CVSS 3.1
EPSS 3.1%
描述
Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.
如何修補 CVE-2018-8023
要修補 CVE-2018-8023,請將受影響套件升級到下列已修補版本。
- —升級至 1.4.2 或更新版本
CVE-2018-8023 正在被利用嗎?
低 — EPSS 為 3.1%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 1.4.2
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
參考連結(4)
- ADVISORYgithub.com/advisories/GHSA-c8cc-p3j7-4c7f
- ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-8023
- WEBlists.apache.org/thread.html/9b9d3f6bd09f3ebd2284b82077033bdc71da550a1c4c010c2494acc3@%3Cdev.mesos.apache.org%3E
- WEBlists.apache.org/thread.html/r0dd7ff197b2e3bdd80a0326587ca3d0c22e10d1dba17c769d6da7d7a@%3Cuser.flink.apache.org%3E