N/A

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.

N/A

N/A

Apache Mesos 安全漏洞

Apache Mesos是美国阿帕奇（Apache）软件基金会的一套支持Hadoop、ElasticSearch和Spark等应用架构的开源群集管理软件。 Apache Mesos中所生成的HMAC值与所提供签名的比对存在安全漏洞。攻击者可利用该漏洞泄露正确的HMAC值。以下版本受到影响：Apache Mesos pre-1.4.2版本，1.5.0版本，1.5.1版本，1.6.0版本。

N/A

N/A