Yelp: Public Github Repo Leaking Internal Credentials

Summary: In Github I found some credentials to use in a mesos.apache.org Github: https://github.com/Yelp/Tron/blob/master/yelppackage/itestdockerfiles/mesos/mesos-secrets https://github.com/Yelp/Tron/blob/master/yelppackage/itestdockerfiles/mesos/mesos-slave-secret POC ss F2021070 F2021071 Login...

io.mantisrx:mantis-control-plane-client (=1.2.28), io.mantisrx:mantis-control-plane-core (=1.2.28) +11 more potentially affected by CVE-2018-1330 via org.apache.mesos:mesos (>=1.4.0 <=1.5.0)

org.apache.mesos:mesos MAVEN version =1.4.0, =2.23.0, =2.7.0, =2.3.0, =2.4.0, =3.2.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.8.0 Source cves: CVE-2018-1330 Source advisory: OSV:GHSA-95Q3-PPPP-R683...

Crash when decoding malformed HTTP requests or malformed JSON payload

When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a...

GHSA-95Q3-PPPP-R683 Crash when decoding malformed HTTP requests or malformed JSON payload

When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a...

GHSA-5Q7J-8HPC-4848 Server-side request forgery vulnerability in Jenkins Mesos Plugin

An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials IDs obtained through another method,...

Server-side request forgery vulnerability in Jenkins Mesos Plugin

An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials IDs obtained through another method,...

Improper authorization vulnerability in Jenkins Mesos Plugin

An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins...

GHSA-23XR-9XXR-VG3C Improper authorization vulnerability in Jenkins Mesos Plugin

An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins...

au.com.skytix:mesos-scheduler-client (>=1.0.11 <=1.0.15), au.com.skytix:velocity-scheduler (>=1.0.34 <=1.0.40) +40 more potentially affected by CVE-2017-9790 via org.apache.mesos:mesos (>=0.9.0-incubating <=1.1.2)

org.apache.mesos:mesos MAVEN version =0.9.0-incubating, =1.0.11, =1.0.34, =2.1.7, =2.1.7, =2.2.0, =2.2.0, =2.1.2, =2.1.2, =0.18.0, =0.1.3, =0.1.3, =0.18.0, =0.18.0, =0.18.0, =0.1.0, =0.2.0 and more Source cves: CVE-2017-9790 Source advisory: OSV:GHSA-VPCV-78CP-WHR3...

com.adobe.api.platform.runtime:mesos (=0.0.2), com.adobe.api.platform.runtime:mesos-actor (>=0.0.3 <=0.0.9) potentially affected by CVE-2017-9790 via org.apache.mesos:mesos (=1.2.1)

org.apache.mesos:mesos MAVEN version =1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.adobe.api.platform.runtime:mesos =0.0.2 - com.adobe.api.platform.runtime:mesos-actor =0.0.3, =0.0.9 Source cve...

Use after free in Apache Mesos

When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore...

GHSA-VPCV-78CP-WHR3 Use after free in Apache Mesos

When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore...

com.adobe.api.platform.runtime:mesos (=0.0.2), com.adobe.api.platform.runtime:mesos-actor (>=0.0.3 <=0.0.9) potentially affected by CVE-2017-7687 via org.apache.mesos:mesos (=1.2.1)

org.apache.mesos:mesos MAVEN version =1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.adobe.api.platform.runtime:mesos =0.0.2 - com.adobe.api.platform.runtime:mesos-actor =0.0.3, =0.0.9 Source cve...

au.com.skytix:mesos-scheduler-client (>=1.0.11 <=1.0.15), au.com.skytix:velocity-scheduler (>=1.0.34 <=1.0.40) +40 more potentially affected by CVE-2017-7687 via org.apache.mesos:mesos (>=0.9.0-incubating <=1.1.2)

org.apache.mesos:mesos MAVEN version =0.9.0-incubating, =1.0.11, =1.0.34, =2.1.7, =2.1.7, =2.2.0, =2.2.0, =2.1.2, =2.1.2, =0.18.0, =0.1.3, =0.1.3, =0.18.0, =0.18.0, =0.18.0, =0.1.0, =0.2.0 and more Source cves: CVE-2017-7687 Source advisory: OSV:GHSA-X869-784M-JMJ2...

Denial of service in Apache Mesos

When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster...

GHSA-X869-784M-JMJ2 Denial of service in Apache Mesos

When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster...

org.apache.beam:beam-runners-twister2 (>=2.23.0 <=2.74.0), org.apache.ignite:ignite-mesos (>=2.7.0 <=2.12.0) +5 more potentially affected by CVE-2019-0204 via org.apache.mesos:mesos (=1.5.0)

org.apache.mesos:mesos MAVEN version =1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - org.apache.beam:beam-runners-twister2 =2.23.0, =2.7.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.8.0 Source cves:...

com.hubspot.mesos.rx.java.example:mesos-rxjava-example-framework (=0.1.0), com.hubspot.mesos.rx.java:mesos-rxjava-protobuf-client (=0.1.0) +4 more potentially affected by CVE-2019-0204 via org.apache.mesos:mesos (=1.6.1)

org.apache.mesos:mesos MAVEN version =1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.hubspot.mesos.rx.java.example:mesos-rxjava-example-framework =0.1.0 -...

au.com.skytix:mesos-scheduler-client (>=1.0.11 <=1.0.15), au.com.skytix:velocity-scheduler (>=1.0.34 <=1.0.40) +44 more potentially affected by CVE-2019-0204 via org.apache.mesos:mesos (>=0.9.0-incubating <=1.4.2)

org.apache.mesos:mesos MAVEN version =0.9.0-incubating, =1.0.11, =1.0.34, =2.1.7, =2.1.7, =2.2.0, =2.2.0, =0.0.3, =2.1.2, =2.1.2, =0.18.0, =0.1.3, =0.1.3, =0.18.0, =0.18.0, =1.5.0 and more Source cves: CVE-2019-0204 Source advisory: OSV:GHSA-32W9-2QPC-5F9V...

Docker image code execution with Apache Mesos

A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain...