1. Home
  2. Vulnerabilities
  3. CVE-2017-7687

CVE-2017-7687

CVSS v3.0 7.5 (High)
75% Progress
CVSS v2.0 5 (Medium)
50% Progress
EPSS 0.08 % (33th)
0.08% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

Weaknesses
CWE-NVD-noinfo
CVE Status
PUBLISHED
CNA
Apache Software Foundation
Published Date
2017-09-29 01:34:50
(7 years ago)
Updated Date
2023-11-07 02:50:15
(10 months ago)

Affected Products

Apache

Configuration #1

    CPE23 From Up To
  Apache Mesos 1.1.2 and prior versions cpe:2.3:a:apache:mesos <= 1.1.2
  Apache Mesos 1.2.0 cpe:2.3:a:apache:mesos:1.2.0
  Apache Mesos 1.2.1 cpe:2.3:a:apache:mesos:1.2.1
  Apache Mesos 1.3.0 cpe:2.3:a:apache:mesos:1.3.0
  Apache Mesos 1.3.1 cpe:2.3:a:apache:mesos:1.3.1
  Apache Mesos 1.4.0-dev cpe:2.3:a:apache:mesos:1.4.0-dev