PT-2019-11188 · Apache · Apache Mesos

Gilbert Song + 1 · Published 2019-03-25 · Updated 2022-05-13 · CVE-2019-0204

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Mesos versions prior to 1.4.x Apache Mesos versions 1.4.0 through 1.4.2 Apache Mesos versions 1.5.0 through 1.5.2 Apache Mesos versions 1.6.0 through 1.6.1 Apache Mesos versions 1.7.0 through 1.7.1

Description: A malicious actor can gain root-level code execution on the host by overwriting the init helper binary of the container runtime and/or the command executor in Apache Mesos using a specifically crafted Docker image running under the root user.

Recommendations: For versions prior to 1.4.x, update to a version newer than 1.4.x. For versions 1.4.0 through 1.4.2, update to a version newer than 1.4.2. For versions 1.5.0 through 1.5.2, update to a version newer than 1.5.2. For versions 1.6.0 through 1.6.1, update to a version newer than 1.6.1. For versions 1.7.0 through 1.7.1, update to a version newer than 1.7.1.

Fix

Related Identifiers

CVE-2019-0204

GHSA-32W9-2QPC-5F9V

Affected Products

Apache Mesos

References · 7

• https://access.redhat.com/errata/RHSA-2019:3892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0204 · Security Note
• https://osv.dev/vulnerability/GHSA-32w9-2qpc-5f9v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0204 · Vendor Advisory
• https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E · Note
• https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c@%3Cdev.mesos.apache.org%3E · Note
• http://securityfocus.com/bid/107605 · Note