CVEvulnerability

CVE-2019-0204

7.8 HIGH Published 2019-03-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-03-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain root-level code execution on the host.

Affected configurations

• apache mesos (>= 1.4.0 < 1.4.3) • apache mesos (>= 1.5.0 < 1.5.3) • apache mesos (>= 1.6.0 < 1.6.2) • apache mesos (>= 1.7.0 < 1.7.2) • apache mesos 1.8.0 • redhat fuse 7.5.0

References