Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-8023

CVE-2018-8023: Moderate severity vulnerability that affects org.apache.mesos:mesos

5.9

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-8023
GHSA ID
GHSA-c8cc-p3j7-4c7f
EPSS Score
0.84712%
CWE
CWE-200
Published
10/17/2018
Updated
1/9/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.mesos:mesosmaven< 1.4.21.4.2
org.apache.mesos:mesosmaven>= 1.5.0, < 1.5.21.5.2
org.apache.mesos:mesosmaven>= 1.6.0, < 1.6.11.6.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure JWT signature comparison in JWT::parse method. The patch shows the security fix replaced a direct string comparison operator ('==') with a constant-time comparison function. The original vulnerable code path in JWT::parse would appear in profilers during signature validation attempts, which is exactly where an attacker would trigger timing measurements. No other functions in the patch show security-sensitive comparisons.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*p**** M*sos **n ** *on*i*ur** to r*quir* *ut**nti**tion to **ll t** *x**utor *TTP *PI usin* JSON W** Tok*n (JWT). In *p**** M*sos v*rsions pr*-*.*.*, *.*.*, *.*.*, *.*.* t** *omp*rison o* t** **n*r*t** *M** v*lu* ***inst t** provi*** si*n*tur* in t*

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* JWT si*n*tur* *omp*rison in JWT::p*rs* m*t*o*. T** p*t** s*ows t** s**urity *ix r*pl**** * *ir**t strin* *omp*rison op*r*tor ('==') wit* * *onst*nt-tim* *omp*rison *un*tion. T** ori*in*l vuln*r**l* *o** p*t* in J