CVE-2017-9790
HighSummary
In Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev, libprocess crashes when handling a libprocess message wrapped in an HTTP request if the request path is empty. The parser assumes the request path always starts with '/'.
Risk Assessment
A malicious actor can cause a denial of service of Mesos masters, rendering the Mesos-controlled cluster inoperable.
Recommendation
It is recommended to upgrade to the latest version of Apache Mesos to mitigate this vulnerability.
Other vulnerabilities in Apache Mesos
Original NVD description (English source)
When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS