PT-2019-11188 · Apache · Apache Mesos

Gilbert Song + 1 · Publicado 2019-03-25 · Atualizado 2022-05-13 · CVE-2019-0204

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Mesos versions prior to 1.4.x Apache Mesos versions 1.4.0 through 1.4.2 Apache Mesos versions 1.5.0 through 1.5.2 Apache Mesos versions 1.6.0 through 1.6.1 Apache Mesos versions 1.7.0 through 1.7.1

Description: A malicious actor can gain root-level code execution on the host by overwriting the init helper binary of the container runtime and/or the command executor in Apache Mesos using a specifically crafted Docker image running under the root user.

Recommendations: For versions prior to 1.4.x, update to a version newer than 1.4.x. For versions 1.4.0 through 1.4.2, update to a version newer than 1.4.2. For versions 1.5.0 through 1.5.2, update to a version newer than 1.5.2. For versions 1.6.0 through 1.6.1, update to a version newer than 1.6.1. For versions 1.7.0 through 1.7.1, update to a version newer than 1.7.1.

Correção

Identificadores relacionados

CVE-2019-0204

GHSA-32W9-2QPC-5F9V

Produtos afetados

Apache Mesos

Referências · 7

• https://access.redhat.com/errata/RHSA-2019:3892 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-0204 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-32w9-2qpc-5f9v · Aviso do Fabricante
• https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E · Nota
• https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c@%3Cdev.mesos.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2019-0204 · Aviso do Fabricante
• http://securityfocus.com/bid/107605 · Nota