CVE-2019-0204

2019-03-2521:43:04

apache

www.cve.org

8.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.8%

JSON

A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain root-level code execution on the host.

CNA Affected

[
  {
    "product": "Apache Mesos",
    "vendor": "Apache",
    "versions": [
      {
        "status": "affected",
        "version": "pre-1.4.x"
      },
      {
        "status": "affected",
        "version": "1.4.0 to 1.4.2"
      },
      {
        "status": "affected",
        "version": "1.5.0 to 1.5.2"
      },
      {
        "status": "affected",
        "version": "1.6.0 to 1.6.1"
      },
      {
        "status": "affected",
        "version": "1.7.0 to 1.7.1"
      }
    ]
  }
]