Timing Attack Vulnerability in Apache Mesos Executor HTTP API

CVE-2018-8023

What is CVE-2018-8023?

Apache Mesos has a vulnerability within its JWT authentication implementation for the Executor HTTP API. Versions prior to 1.4.2 and specific builds of 1.5.x and 1.6.0 utilize a non-secure string comparison method, allowing an attacker to exploit timing discrepancies during JWT validation. This timing attack can facilitate unauthorized access, enabling malicious users to deduce the correct HMAC value by measuring the response time variations in the API's validation process.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References