GHSA-W4R4-65MG-45X2 org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

com.dangdang:elastic-job-cloud-executor (>=2.0.0, <=2.0.2), com.dangdang:elastic-job-cloud-scheduler (>=2.0.0, <=2.0.2) +13 more potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.28.1)

org.apache.mesos:mesos MAVEN version 0.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.dangdang:elastic-job-cloud-executor =2.0.0, =2.0.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0,...

GHSA-C8CC-P3J7-4C7F Moderate severity vulnerability that affects org.apache.mesos:mesos

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token JWT. In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timi...

org.spark-project:spark-bagel_2.9.2 (>=0.5.1, <=0.5.2), org.spark-project:spark-core_2.9.2 (>=0.5.1, <=0.5.2) +2 more potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.9.0-incubating)

org.apache.mesos:mesos MAVEN version 0.9.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - org.spark-project:spark-bagel2.9.2 =0.5.1, =0.5.1, =0.5.1, =0.5.1, =0.5.2 Source cves: CVE-2018-8023...

com.hubspot:singularitybase (>=0.3.0, <=0.3.2), com.hubspot:singularityclient (>=0.3.0, <=0.3.2) +2 more potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.17.0)

org.apache.mesos:mesos MAVEN version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.hubspot:singularitybase =0.3.0, =0.3.0, =0.3.0, =0.3.2 - org.jenkins-ci.plugins:mesos 0.2.0 Source cves:...

com.hubspot:singularitybase (0.3.8), com.hubspot:singularityclient (0.3.8) +3 more potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.19.1)

org.apache.mesos:mesos MAVEN version 0.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.hubspot:singularitybase 0.3.8 - com.hubspot:singularityclient 0.3.8 - com.hubspot:singularitymesosclient 0.3.8...

org.jenkins-ci.plugins:mesos (0.5.0) potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.20.0)

org.apache.mesos:mesos MAVEN version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - org.jenkins-ci.plugins:mesos 0.5.0 Source cves: CVE-2018-8023 Source advisory: OSV:GHSA-C8CC-P3J7-4C7F...

com.groupon.mesos:jesos (1.4), org.apache.ignite:ignite-mesos (>=1.2.0-incubating, <=2.6.0) potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.22.0)

org.apache.mesos:mesos MAVEN version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.groupon.mesos:jesos 1.4 - org.apache.ignite:ignite-mesos =1.2.0-incubating, =2.6.0 Source cves: CVE-2018-8023...

org.jenkins-ci.plugins:mesos (>=0.8.0, <=0.10.1) potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.22.1)

org.apache.mesos:mesos MAVEN version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - org.jenkins-ci.plugins:mesos =0.8.0, =0.10.1 Source cves: CVE-2018-8023 Source advisory: OSV:GHSA-C8CC-P3J7-4C7F...

com.datastax.spark:spark-cassandra-connector-demos_2.10 (>=1.0.0-rc3, <=1.0.6), com.datastax.spark:spark-cassandra-connector-java_2.10 (>=1.0.0-rc3, <=1.0.6) +26 more potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.13.0)

org.apache.mesos:mesos MAVEN version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.datastax.spark:spark-cassandra-connector-demos2.10 =1.0.0-rc3, =1.0.0-rc3, =1.0.0-beta1, =0.2.2, =0.2.2, =0.2....

com.hubspot:singularitybase (>=0.1.1, <=0.1.2), com.hubspot:singularityclient (>=0.1.1, <=0.1.2) potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.14.0)

org.apache.mesos:mesos MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.hubspot:singularitybase =0.1.1, =0.1.1, =0.1.2 Source cves: CVE-2018-8023 Source advisory:...

org.apache.hama:hama-mesos (>=0.7.0, <=0.7.1) potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.15.0)

org.apache.mesos:mesos MAVEN version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - org.apache.hama:hama-mesos =0.7.0, =0.7.1 Source cves: CVE-2018-8023 Source advisory: OSV:GHSA-C8CC-P3J7-4C7F...

io.verizon.ark:core_2.10 (0.1.3), io.verizon.ark:example_2.10 (0.1.3) potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.26.0)

org.apache.mesos:mesos MAVEN version 0.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - io.verizon.ark:core2.10 0.1.3 - io.verizon.ark:example2.10 0.1.3 Source cves: CVE-2018-8023 Source advisory:...

com.dangdang:elastic-job-cloud-executor (>=2.0.3, <=2.1.1), com.dangdang:elastic-job-cloud-scheduler (>=2.0.3, <=2.1.1) +17 more potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.28.2)

org.apache.mesos:mesos MAVEN version 0.28.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.dangdang:elastic-job-cloud-executor =2.0.3, =2.0.3, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0,...

org.jenkins-ci.plugins:mesos (0.4.0) potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.19.0)

org.apache.mesos:mesos MAVEN version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - org.jenkins-ci.plugins:mesos 0.4.0 Source cves: CVE-2018-8023 Source advisory: OSV:GHSA-C8CC-P3J7-4C7F...

org.jenkins-ci.plugins:mesos (>=0.11.0, <=0.13.1) potentially affected by CVE-2018-8023 via org.apache.mesos:mesos (0.27.0)

org.apache.mesos:mesos MAVEN version 0.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - org.jenkins-ci.plugins:mesos =0.11.0, =0.13.1 Source cves: CVE-2018-8023 Source advisory: OSV:GHSA-C8CC-P3J7-4C7F...

Moderate severity vulnerability that affects org.apache.mesos:mesos

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token JWT. In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timi...

Apache Mesos Information Disclosure Vulnerability

Apache Mesos is the United States Apache Apache Software Foundation of a set of support for Hadoop, ElasticSearch and Spark and other application architecture of open source cluster management software. A security vulnerability exists in the comparison of the HMAC values generated in Apache Mesos...

CVE-2018-8023

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token JWT. In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timi...

Unprivileged users with Overall/Read access are able to enumerate credential IDs in Mesos Plugin

Mesos Plugin provides a list of applicable credential IDs to allow administrators configuring the Mesos cloud to select the one to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part ...