{"id":"CVE-2018-8023","aliases":["GHSA-c8cc-p3j7-4c7f"],"url":"https://o3.security/vulnerability/CVE-2018-8023","summary":"Moderate severity vulnerability that affects org.apache.mesos:mesos","details":"Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.","published":"2018-09-21T13:29:01.140Z","modified":"2026-07-08T05:54:38.712079073Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.mesos:mesos","fixedVersion":"1.4.2"},{"ecosystem":"Maven","name":"org.apache.mesos:mesos","fixedVersion":"1.5.2"},{"ecosystem":"Maven","name":"org.apache.mesos:mesos","fixedVersion":"1.6.1"}],"fix":null,"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/9b9d3f6bd09f3ebd2284b82077033bdc71da550a1c4c010c2494acc3%40%3Cdev.mesos.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r0dd7ff197b2e3bdd80a0326587ca3d0c22e10d1dba17c769d6da7d7a%40%3Cuser.flink.apache.org%3E"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:54:38.712079073Z"}}