CVE-2018-1330

Vulnerability

libprocess in Apache Mesos versions 1.4.0 to 1.5.0 [1] contains two denial-of-service weaknesses. First, parsing a malformed JSON payload triggers an uncaught exception, causing a crash. Second, parsing chunked HTTP requests with trailers hits a mistakenly planted assertion, also leading to a crash. Both code paths are reachable without special configuration beyond having libprocess listen for HTTP requests.

Exploitation

An attacker can send a crafted JSON payload or a chunked HTTP request with malicious trailers to a Mesos master's libprocess endpoint. No authentication is required; the attacker only needs network access to the target master's port. The malformed input triggers either the uncaught exception or the assertion, crashing the process.

Impact

A successful exploit causes a denial of service of the targeted Mesos master, rendering the entire Mesos-controlled cluster inoperable because masters coordinate resource offers and task scheduling. The crash can be repeated to maintain the outage.

Mitigation

Apache Mesos released version 1.5.1 (and later) with the fix; users should upgrade to 1.5.1 or newer [1]. No workarounds are documented in the available references. The vulnerability is not known to be listed in CISA's KEV.