When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published: 2017-09-28T20:00:00Z

Updated: 2024-09-16T22:14:23.745Z

Reserved: 2017-06-21T00:00:00

Link: CVE-2017-9790

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2017-09-29T01:34:50.640

Modified: 2024-11-21T03:36:51.527

Link: CVE-2017-9790

cve-icon Redhat

No data.