Bug 1632810 (CVE-2018-8023)

Summary:	CVE-2018-8023 mesos: Exposure of HMAC value via timing vulnerability in JWT validation
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	lloesche+fedora, negativo17
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mesos 1.4.2, mesos 1.5.2, mesos 1.6.1, mesos 1.7.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-12-13 20:09:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1632811
Bug Blocks:	1632812

Description Pedro Sampaio 2018-09-25 15:30:10 UTC

Apache Mesos can be configured to require authentication to call the
Executor HTTP API using JSON Web Token (JWT). The comparison of the
generated HMAC value against the provided signature in the JWT
implementation used is vulnerable to a timing attack because instead
of a constant-time string comparison routine a standard `==` operator
has been used. A malicious actor can therefore abuse the timing
difference of when the JWT validation function returns to reveal the
correct HMAC value.

Upstream patch:

https://github.com/apache/mesos/commit/2c282f19755ea7518caf6f43e729524b1c6bdb23

References:

https://seclists.org/oss-sec/2018/q3/267

Comment 1 Pedro Sampaio 2018-09-25 15:30:43 UTC

Created mesos tracking bugs for this issue:

Affects: fedora-all [bug 1632811]

Comment 3 Product Security DevOps Team 2019-12-13 20:09:22 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-8023