Information disclosure in Apache Mesos
Priority LOW 32CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.
Why it matters now
EPSS 0.03056 87th percentileScored 2026-11-07
Fix Fixed Apache Mesos (Apache Software Foundation): 1.4.2org.apache.mesos:mesos (Maven): 1.4.2, 1.5.2, 1.6.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Mesos | before 1.4.2; 1.5.0, 1.5.1; 1.6.0 | 1.4.2 | Patch available | CNA |
| — | org.apache.mesos:mesos (Maven) | before 1.4.2 | 1.4.2 | Patch available | GHSA-c8cc-p3j7-4c7f |
| — | org.apache.mesos:mesos (Maven) | 1.5.0 to before 1.5.2 | 1.5.2 | Patch available | GHSA-c8cc-p3j7-4c7f |
| — | org.apache.mesos:mesos (Maven) | 1.6.0 to before 1.6.1 | 1.6.1 | Patch available | GHSA-c8cc-p3j7-4c7f |
- Apache Mesos VendorApache Affected before 1.4.2; 1.5.0, 1.5.1; 1.6.0 Fixed in 1.4.2 Patch available CNA
- org.apache.mesos:mesos (Maven) Vendor— Affected before 1.4.2 Fixed in 1.4.2 Patch available GHSA-c8cc-p3j7-4c7f
- org.apache.mesos:mesos (Maven) Vendor— Affected 1.5.0 to before 1.5.2 Fixed in 1.5.2 Patch available GHSA-c8cc-p3j7-4c7f
- org.apache.mesos:mesos (Maven) Vendor— Affected 1.6.0 to before 1.6.1 Fixed in 1.6.1 Patch available GHSA-c8cc-p3j7-4c7f
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:* | before 1.4.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:mesos:1.5.0:*:*:*:*:*:*:* | 1.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:mesos:1.5.1:*:*:*:*:*:*:* | 1.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:mesos:1.6.0:*:*:*:*:*:*:* | 1.6.0 | Vulnerable | Apache |
- cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:* Versions before 1.4.2 Vulnerable ·Apache
- cpe:2.3:a:apache:mesos:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:mesos:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:mesos:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Apache
Remediation
- Fix · CNA Apache Mesos (Apache Software Foundation) Fixed in 1.4.2
- Fix · GHSA-c8cc-p3j7-4c7f org.apache.mesos:mesos (Maven) Fixed in 1.4.2 Advisory →
- Fix · GHSA-c8cc-p3j7-4c7f org.apache.mesos:mesos (Maven) Fixed in 1.5.2 Advisory →
- Fix · GHSA-c8cc-p3j7-4c7f org.apache.mesos:mesos (Maven) Fixed in 1.6.1 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2018-8023
- 2026-10-03 Alias added: GHSA-c8cc-p3j7-4c7f
References
Advisory 2
Other 4
- [dev] 20180921 CVE-2018-8023: A remote attacker can exploit a vulnerability in the JWT implementation to gain unauthenticated access to Mesos Executor HTTP API.
- [flink-user] 20201022 Dependency vulnerabilities with flink 1.11.1 version
- https://lists.apache.org/thread.html/9b9d3f6bd09f3ebd2284b82077033bdc71da550a1c4c010c2494acc3@%3Cdev.mesos.apache.org%3E
- https://lists.apache.org/thread.html/r0dd7ff197b2e3bdd80a0326587ca3d0c22e10d1dba17c769d6da7d7a@%3Cuser.flink.apache.org%3E
More Apache Mesos vulnerabilities
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
- TI-2018-08449 Memory corruption in Apache Mesos CVSS 3.0HIGH 7.5
- TI-2019-00180 A specifically crafted Docker image running under the root user can overwrite the init… CVSS 3.1HIGH 7.8
- TI-2018-01231 Improper input validation in Apache Mesos CVSS 3.0HIGH 7.5
- TI-2017-07170 Use after free in Apache Mesos CVSS 3.0HIGH 7.5
- TI-2017-05323 When handling a decoding failure for a malformed URL path of an HTTP request, libprocess… CVSS 3.0HIGH 7.5
Sources
- CVE-2018-8023 · CVE Program
- CVE-2018-8023 · NVD
- FIRST EPSS
- GHSA-c8cc-p3j7-4c7f · GitHub Advisory Database · CC BY 4.0
- CVE-2018-8023 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences